postgres-operator
postgres-operator copied to clipboard
CrunchyData
Set Postgres users' passwords declaratively
Overview
#2807 provided a way to set a password for a user using kubectl patch.
But there doesn't seem to be a way to do this declaratively in my postgres.yaml file.
Use Case
We're importing existing databases into a LAN-only k8s cluster and these clusters have existing passwords we'd like to keep using.
We're destroying and re-creating PGO clusters, but I can't fix their passwords in place.
Desired Behavior
PostgresCluster.spec.users[index].password would provide a passthrough for stringData and/or data.
Or maybe explicit password and verifier fields, whatever makes more sense.
Environment
Tell us about your environment:
Please provide the following details:
- Platform: EKS
- Platform Version: eks.2 k8s 1.22
- PGO Image Tag:
ubi8-14.2-1 - Postgres Version:
14 - Storage:
gp3 - Number of Postgres clusters:
2
any way of providing a password through secret/configmap ref would suffice, actually
https://access.crunchydata.com/documentation/postgres-operator/5.1.2/architecture/user-management/#custom-passwords there is a way tho
https://access.crunchydata.com/documentation/postgres-operator/5.1.2/architecture/user-management/#custom-passwords there is a way tho
Yeah, I've mentioned that in the first line of my ticket. This is about being able to do it declaratively through manifests (AWS CDK in my case), this helps with repeatable deployments or high volumes.
Ist there any commitment or workaround (not the manual patch-way) for this enhancement?
I would like to set a custom password by using a secretRef. The referenced secret would be created for example via sealedsecrets-operator.
I would like to use this enhancement for a Gitops-workflow.
Hello, @gricey432! We've captured this request in our backlog. Thanks.
bump, this would be very useful for us to allow the usage of secretRefs. We store our secrets in an external secret manager and would like to use this secret.
+1 We would definitely love the possibility of secretRef for the external secret with password. Currently, in our gitops workflow we have to create Kyverno policy to patch pguser secret (To allow sealed secrets controller patch and manage existing file) and then patching the password key using sealed secret. Not a very nice gitops/declarative approach at all.
