Skip to content

Support user-supplied pg_hba rules via configSecret key user_hba.conf #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
souravbiswassanto merged 1 commit into from
Aug 25, 2026
Merged

Support user-supplied pg_hba rules via configSecret key user_hba.conf #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions role_scripts/10/primary/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
Expand All @@ -267,6 +278,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand All @@ -283,6 +305,17 @@ else
{ echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand Down
33 changes: 33 additions & 0 deletions role_scripts/10/standby/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
Expand All @@ -248,6 +259,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand All @@ -264,6 +286,17 @@ else
{ echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand Down
55 changes: 55 additions & 0 deletions role_scripts/11/primary/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf
Expand All @@ -277,6 +288,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf
Expand All @@ -291,6 +313,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then
{ echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand All @@ -308,6 +341,17 @@ else
{ echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf
{ echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf
Expand All @@ -322,6 +366,17 @@ else
{ echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf

# KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf).
# They go before the catch-all rules below (pg_hba.conf is first-match-wins)
# and after the local/loopback rules above, so custom rules can override the
# defaults but cannot lock out the operator's own scripts.
# PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is
# copied in at generation time; secret changes take effect on pod restart.
if [[ -s /etc/config/user_hba.conf ]]; then
cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf
echo '' >>/tmp/pg_hba.conf
fi

{ echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf
{ echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf
Expand Down
Loading
Loading