zalando / zalando/postgres-operator
operator allow to create cluster with TLS disabled but pooler - not
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.2k
- Forks
- 1.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 3
Description
Operator allow to create cluster without enforced secure connections, but bundled pgBouncer enforce it.
- Which image of the operator are you using? e.g. registry.opensource.zalan.do/acid/postgres-operator:v1.11.0
- Where do you run it - cloud or metal? Kubernetes or OpenShift? [DigitalOcean K8s]
- Are you running Postgres Operator in production? yes
- Type of issue? Bug report
We set ALLOW_NOSSL: "true" for our clusters via ConfigMap and now we want to use connection pooler. However it is enforce secure connections:
server_tls_sslmode = require
server_tls_ca_file = /etc/ssl/certs/pgbouncer.crt
server_tls_protocols = secure
client_tls_sslmode = require
Please, make it configurable or allow insecure connections with looser restrictions:
server_tls_sslmode = prefer
client_tls_sslmode = prefer
It is backward compatible with existent configurations and do not harm anyone
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect how ALLOW_NOSSL is propagated into the bundled pgBouncer TLS configuration, focusing on the operator's pooler configuration entry points. Compare the enforced settings with the requested prefer behavior and verify that existing secure configurations remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, postgresql
- Domain
- databases, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100