diff --git a/role_scripts/10/primary/start.sh b/role_scripts/10/primary/start.sh index 82b95fb..a98323b 100755 --- a/role_scripts/10/primary/start.sh +++ b/role_scripts/10/primary/start.sh @@ -253,6 +253,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -267,6 +278,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -283,6 +305,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/10/standby/run.sh b/role_scripts/10/standby/run.sh index e7ca899..0320ae1 100755 --- a/role_scripts/10/standby/run.sh +++ b/role_scripts/10/standby/run.sh @@ -234,6 +234,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -248,6 +259,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -264,6 +286,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/11/primary/start.sh b/role_scripts/11/primary/start.sh index c57f807..f83706d 100755 --- a/role_scripts/11/primary/start.sh +++ b/role_scripts/11/primary/start.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -277,6 +288,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -291,6 +313,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -308,6 +341,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -322,6 +366,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/11/standby/run.sh b/role_scripts/11/standby/run.sh index ffd1391..0fb80c2 100755 --- a/role_scripts/11/standby/run.sh +++ b/role_scripts/11/standby/run.sh @@ -242,6 +242,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -256,6 +267,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -270,6 +292,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -287,6 +320,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -301,6 +345,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/12/primary/start.sh b/role_scripts/12/primary/start.sh index 2c40315..085572b 100755 --- a/role_scripts/12/primary/start.sh +++ b/role_scripts/12/primary/start.sh @@ -283,6 +283,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -297,6 +308,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -311,6 +333,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -328,6 +361,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -342,6 +386,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/12/standby/run.sh b/role_scripts/12/standby/run.sh index 4b3594e..85cc2cb 100755 --- a/role_scripts/12/standby/run.sh +++ b/role_scripts/12/standby/run.sh @@ -257,6 +257,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -271,6 +282,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -285,6 +307,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -302,6 +335,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -316,6 +360,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/primary/start.sh b/role_scripts/13/primary/start.sh index cafc761..3cadcce 100755 --- a/role_scripts/13/primary/start.sh +++ b/role_scripts/13/primary/start.sh @@ -304,6 +304,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -320,6 +331,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -336,6 +358,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -355,6 +388,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -371,6 +415,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/standby/remote-replica.sh b/role_scripts/13/standby/remote-replica.sh index 0119920..93c522e 100755 --- a/role_scripts/13/standby/remote-replica.sh +++ b/role_scripts/13/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/standby/run.sh b/role_scripts/13/standby/run.sh index c6cc7b9..7eee1d4 100755 --- a/role_scripts/13/standby/run.sh +++ b/role_scripts/13/standby/run.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -279,6 +290,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -295,6 +317,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -314,6 +347,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -330,6 +374,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/primary/start.sh b/role_scripts/14/primary/start.sh index 7ebe72e..6015005 100755 --- a/role_scripts/14/primary/start.sh +++ b/role_scripts/14/primary/start.sh @@ -308,6 +308,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -324,6 +335,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -340,6 +362,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -359,6 +392,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -375,6 +419,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/standby/remote-replica.sh b/role_scripts/14/standby/remote-replica.sh index ce4385c..8841aec 100755 --- a/role_scripts/14/standby/remote-replica.sh +++ b/role_scripts/14/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/standby/run.sh b/role_scripts/14/standby/run.sh index 25a5fbe..7db01e1 100755 --- a/role_scripts/14/standby/run.sh +++ b/role_scripts/14/standby/run.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -279,6 +290,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -295,6 +317,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -314,6 +347,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -330,6 +374,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/primary/start.sh b/role_scripts/15/primary/start.sh index f128bd2..8896043 100755 --- a/role_scripts/15/primary/start.sh +++ b/role_scripts/15/primary/start.sh @@ -311,6 +311,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -327,6 +338,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -343,6 +365,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -362,6 +395,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -378,6 +422,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/standby/remote-replica.sh b/role_scripts/15/standby/remote-replica.sh index ce4385c..8841aec 100755 --- a/role_scripts/15/standby/remote-replica.sh +++ b/role_scripts/15/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/standby/run.sh b/role_scripts/15/standby/run.sh index b0df61b..57c21cc 100755 --- a/role_scripts/15/standby/run.sh +++ b/role_scripts/15/standby/run.sh @@ -262,6 +262,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -278,6 +289,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -294,6 +316,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -313,6 +346,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -329,6 +373,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/primary/start.sh b/role_scripts/16/primary/start.sh index 21980b6..9ecc8d9 100755 --- a/role_scripts/16/primary/start.sh +++ b/role_scripts/16/primary/start.sh @@ -310,6 +310,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -326,6 +333,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -342,6 +356,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -361,6 +382,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -377,6 +405,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/standby/remote-replica.sh b/role_scripts/16/standby/remote-replica.sh index 2d55270..4ee0698 100755 --- a/role_scripts/16/standby/remote-replica.sh +++ b/role_scripts/16/standby/remote-replica.sh @@ -172,6 +172,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -186,6 +193,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -200,6 +214,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -217,6 +238,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -231,6 +259,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/standby/run.sh b/role_scripts/16/standby/run.sh index afde4c0..63abf86 100755 --- a/role_scripts/16/standby/run.sh +++ b/role_scripts/16/standby/run.sh @@ -261,6 +261,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -277,6 +284,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -293,6 +307,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -312,6 +333,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -328,6 +356,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/primary/start.sh b/role_scripts/17/primary/start.sh index 81bd2c6..783406a 100755 --- a/role_scripts/17/primary/start.sh +++ b/role_scripts/17/primary/start.sh @@ -320,6 +320,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -336,6 +343,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -352,6 +366,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -371,6 +392,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -387,6 +415,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/standby/remote-replica.sh b/role_scripts/17/standby/remote-replica.sh index 8346c26..514fc6b 100755 --- a/role_scripts/17/standby/remote-replica.sh +++ b/role_scripts/17/standby/remote-replica.sh @@ -177,6 +177,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -191,6 +198,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -205,6 +219,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -222,6 +243,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -236,6 +264,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/standby/run.sh b/role_scripts/17/standby/run.sh index 76e0150..8e518e4 100755 --- a/role_scripts/17/standby/run.sh +++ b/role_scripts/17/standby/run.sh @@ -266,6 +266,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -282,6 +289,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -298,6 +312,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -317,6 +338,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -333,6 +361,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/primary/start.sh b/role_scripts/18/primary/start.sh index 87b0c07..ab734d6 100755 --- a/role_scripts/18/primary/start.sh +++ b/role_scripts/18/primary/start.sh @@ -313,6 +313,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -329,6 +336,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -345,6 +359,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -364,6 +385,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -380,6 +408,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/standby/remote-replica.sh b/role_scripts/18/standby/remote-replica.sh index 8346c26..514fc6b 100755 --- a/role_scripts/18/standby/remote-replica.sh +++ b/role_scripts/18/standby/remote-replica.sh @@ -177,6 +177,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -191,6 +198,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -205,6 +219,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -222,6 +243,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -236,6 +264,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/standby/run.sh b/role_scripts/18/standby/run.sh index 76e0150..8e518e4 100755 --- a/role_scripts/18/standby/run.sh +++ b/role_scripts/18/standby/run.sh @@ -266,6 +266,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -282,6 +289,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -298,6 +312,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -317,6 +338,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -333,6 +361,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/9/primary/start.sh b/role_scripts/9/primary/start.sh index 25a4d9c..1d98613 100755 --- a/role_scripts/9/primary/start.sh +++ b/role_scripts/9/primary/start.sh @@ -248,6 +248,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -262,6 +273,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -278,6 +300,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/9/standby/run.sh b/role_scripts/9/standby/run.sh index bb43de4..fca2cd9 100755 --- a/role_scripts/9/standby/run.sh +++ b/role_scripts/9/standby/run.sh @@ -231,6 +231,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -245,6 +256,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -261,6 +283,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf