gitops-platform-bootstrap/postgres/values.yaml at main · Microservices-Demo-Projects/gitops-platform-bootstrap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# Wrapper chart values for Bitnami PostgreSQL.
# This chart is configured for OpenShift by default.
postgresql:
  # OpenShift Compatibility: Scale-to-zero and non-root user support
  # Note: Standard Kubernetes will require these to be true or specific IDs set.
  # In OpenShift, the default SCC handles volume permissions.
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  volumePermissions:
     enabled: false

  # -----------------------
  # TLS (Server-side)
  # -----------------------
  tls:
    enabled: true
    autoGenerated: false
    certificatesSecret: postgres-tls
    certKeyFilename: tls.key
    certFilename: tls.crt
    certCAFilename: ca.crt
  # -----------------------
  # Auth
  # -----------------------
  auth:
    enablePostgresUser: true
    existingSecret: postgres-root-password
    secretKeys:
      adminPasswordKey: password

  primary:
    initdb:
      scripts:
        01-create-vault-user.sql: |
          -- Creating vault user without password i.e., it will login with cert / mTLS only
          -- Vault user is purely for role management i.e., create new users and rotating credentails.
          CREATE USER vault WITH CREATEROLE;

    pgHbaConfiguration: |

      # ----------------------------------------------------------------------
      # 1. mTLS ONLY user vault without password fallback
      # ----------------------------------------------------------------------
      hostssl all vault 0.0.0.0/0 cert clientcert=verify-full
      hostssl all vault ::/0       cert clientcert=verify-full

      # ----------------------------------------------------------------------
      # 2. For vault-generated users Allow: TLS + password only
      # Vault created users/role are identified by the prefix: vlt_
      # ----------------------------------------------------------------------
      hostssl all vlt_+ 0.0.0.0/0 scram-sha-256
      hostssl all vlt_+ ::/0       scram-sha-256

      # ----------------------------------------------------------------------
      # 3. Other users (ALLOW BOTH mTLS and TLS+password)
      # ----------------------------------------------------------------------
      # 3a. If client cert is present then use: mTLS
      hostssl all all 0.0.0.0/0 cert clientcert=verify-full
      hostssl all all ::/0       cert clientcert=verify-full

      # 3b. If no client cert then use: TLS + password
      hostssl all all 0.0.0.0/0 scram-sha-256
      hostssl all all ::/0       scram-sha-256

      # ----------------------------------------------------------------------
      # 4. Local connections (still TLS-free, but internal)
      # This is applicable for when we login to the pod and connect using the
      # postgres user (i.e., break-glass only)
      #----------------------------------------------------------------------
      local all all scram-sha-256