Is it possible to disable pg_hba.conf local trust?

Please, answer some short questions which should help us to understand your problem / question better?

• Which image of the operator are you using? registry.opensource.zalan.do/acid/postgres-operator:v1.6.3
• Type of issue? question

I've been digging through this repo and the patroni repo to find info on this, but I haven't had much luck.

The pg_hba.conf used by the postgres-operator PostgreSQL deployment has this line:

local   all             all                                   trust

This gives full password-less access to all Postgres users to any user running on the local command-line.

This in turn means that anyone with kubectl exec access can access any database on the cluster:

kubectl exec -it test-db -- psql -U postgres

psql (13.3 (Ubuntu 13.3-1.pgdg18.04+1))
Type "help" for help.

postgres=#

This behavior is less than ideal from a security standpoint.

Is this permissive trust required for some functionality in the postgres-operator? Is it possible to disable this behavior by modifying the pg_hba.conf ?

Start with the postgres-operator PostgreSQL deployment, the generated pg_hba.conf entry, and the related Patroni behavior mentioned in the report. Reproduce the local psql access through kubectl exec and determine whether trust is required by the operator. Done means documenting the requirement and providing or confirming a supported way to disable passwordless local access.