Add ssl options to postgres pillar

changelog/67720.added.md

@@ -0,0 +1 @@
+Added ssl options to postgres pillar.

requirements/static/ci/common.in

@@ -50,3 +50,4 @@ genshi>=0.7.3
 cheetah3>=3.2.2
 mako
 wempy
+psycopg2-binary

requirements/static/ci/py3.10/darwin.txt

@@ -322,6 +322,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.10/freebsd.txt

@@ -326,6 +326,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.10/linux.txt

@@ -352,6 +352,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.10/windows.txt

@@ -284,6 +284,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.11/darwin.txt

@@ -315,6 +315,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.11/freebsd.txt

@@ -319,6 +319,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.11/linux.txt

@@ -343,6 +343,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.11/windows.txt

@@ -277,6 +277,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.12/cloud.txt

@@ -441,6 +441,10 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via
+    #   -c requirements/static/ci/py3.12/linux.txt
+    #   -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via
     #   -c requirements/static/ci/py3.12/linux.txt

requirements/static/ci/py3.12/darwin.txt

@@ -315,6 +315,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.12/freebsd.txt

@@ -319,6 +319,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.12/lint.txt

@@ -464,6 +464,10 @@ psutil==5.9.6
     #   -c requirements/static/ci/../pkg/py3.12/linux.txt
     #   -c requirements/static/ci/py3.12/linux.txt
     #   -r requirements/base.txt
+psycopg2-binary==2.9.10
+    # via
+    #   -c requirements/static/ci/py3.12/linux.txt
+    #   -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via
     #   -c requirements/static/ci/py3.12/linux.txt

requirements/static/ci/py3.12/linux.txt

@@ -343,6 +343,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.12/windows.txt

@@ -277,6 +277,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.13/cloud.txt

@@ -431,6 +431,10 @@ psutil==6.1.0
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via
+    #   -c requirements/static/ci/py3.13/linux.txt
+    #   -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via
     #   -c requirements/static/ci/py3.13/linux.txt

requirements/static/ci/py3.13/darwin.txt

@@ -307,6 +307,8 @@ psutil==6.1.0
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via google-auth
 pyasn1==0.6.1

requirements/static/ci/py3.13/freebsd.txt

@@ -311,6 +311,8 @@ psutil==6.1.0
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via google-auth
 pyasn1==0.6.1

requirements/static/ci/py3.13/lint.txt

@@ -453,6 +453,10 @@ psutil==6.1.0
     #   -c requirements/static/ci/../pkg/py3.13/linux.txt
     #   -c requirements/static/ci/py3.13/linux.txt
     #   -r requirements/base.txt
+psycopg2-binary==2.9.10
+    # via
+    #   -c requirements/static/ci/py3.13/linux.txt
+    #   -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via
     #   -c requirements/static/ci/py3.13/linux.txt

requirements/static/ci/py3.13/linux.txt

@@ -335,6 +335,8 @@ psutil==6.1.0
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via google-auth
 pyasn1==0.6.1

requirements/static/ci/py3.13/windows.txt

@@ -276,6 +276,8 @@ psutil==6.1.0
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.4.1
     # via google-auth
 pyasn1==0.6.1

requirements/static/ci/py3.8/freebsd.txt

@@ -330,6 +330,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.8/linux.txt

@@ -349,6 +349,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.8/windows.txt

@@ -288,6 +288,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.9/darwin.txt

@@ -322,6 +322,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.9/freebsd.txt

@@ -326,6 +326,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.9/linux.txt

@@ -345,6 +345,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

requirements/static/ci/py3.9/windows.txt

@@ -284,6 +284,8 @@ psutil==5.9.6
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.10
+    # via -r requirements/static/ci/common.in
 pyasn1-modules==0.3.0
     # via google-auth
 pyasn1==0.5.1

salt/pillar/postgres.py

@@ -69,6 +69,12 @@ def _get_options(self):
             "pass": "salt",
             "db": "salt",
             "port": 5432,
+            "sslmode": "prefer",
+            "sslcert": None,
+            "sslkey": None,
+            "sslrootcert": None,
+            "sslcrl": None,
+            "kwargs": {},
         }
         _options = {}
         _opts = __opts__.get("postgres", {})
@@ -92,6 +98,12 @@ def _get_cursor(self):
             password=_options["pass"],
             dbname=_options["db"],
             port=_options["port"],
+            sslmode=_options["sslmode"],
+            sslcert=_options["sslcert"],
+            sslkey=_options["sslkey"],
+            sslrootcert=_options["sslrootcert"],
+            sslcrl=_options["sslcrl"],
+            **_options["kwargs"],
         )
         cursor = conn.cursor()
         try:

tests/pytests/unit/pillar/test_postgres.py

@@ -0,0 +1,67 @@
+import pytest
+
+import salt.pillar.postgres as postgres
+from tests.support.mock import MagicMock, patch
+
+try:
+    import psycopg2  # pylint: disable=unused-import
+
+    HAS_POSTGRES = True
+except ImportError:
+    HAS_POSTGRES = False
+pytestmark = [
+    pytest.mark.skipif(not HAS_POSTGRES, reason="Package psycopg2 is not installed."),
+]
+
+
+def test_should_pass_ssl_args():
+    postgres_opts = {
+        "postgres": {
+            "host": "postgres",
+            "sslmode": "verify-ca",
+            "sslcert": "/path/to/sslcert",
+            "sslkey": "/path/to/sslkey",
+            "sslrootcert": "/path/to/sslrootcert",
+            "sslcrl": "/path/to/sslcrl",
+            "kwargs": {"application_name": "salt"},
+        }
+    }
+    with (
+        patch("salt.pillar.postgres.__opts__", postgres_opts, create=True),
+        patch("psycopg2.connect", MagicMock()) as connect_mock,
+    ):
+        postgres.ext_pillar("test", {})
+    connect_mock.assert_called_with(
+        host="postgres",
+        user="salt",
+        password="salt",
+        dbname="salt",
+        port=5432,
+        sslmode="verify-ca",
+        sslcert="/path/to/sslcert",
+        sslkey="/path/to/sslkey",
+        sslrootcert="/path/to/sslrootcert",
+        sslcrl="/path/to/sslcrl",
+        application_name="salt",
+    )
+
+
+def test_should_pass_default_args():
+    postgres_opts = {}
+    with (
+        patch("salt.pillar.postgres.__opts__", postgres_opts, create=True),
+        patch("psycopg2.connect", MagicMock()) as connect_mock,
+    ):
+        postgres.ext_pillar("test", {})
+    connect_mock.assert_called_with(
+        host="localhost",
+        user="salt",
+        password="salt",
+        dbname="salt",
+        port=5432,
+        sslmode="prefer",
+        sslcert=None,
+        sslkey=None,
+        sslrootcert=None,
+        sslcrl=None,
+    )