Repository navigation
Authenticate bundled PostgreSQL logins with separate pod certificates - #2266
Conversation
Issue owner and read/write certificates only to API-server pods and require each certificate common name to match its database login. Replace bundled database passwords with projected credentials while preserving separate role grants.
|
I'll defer to Eitan and Taahir for merge |
|
LGTM as well, I think should leave final to Taahir Ahmed (@ahmedtd) |
| // Each bundled connection presents a certificate for its own login user. | ||
| func bundledPostgresDSN(user string) string { | ||
| bundle := "/run/postgres.podcert.ate.dev/" + user + ".pem" | ||
| return fmt.Sprintf("postgresql://%[email protected]:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=%s&sslkey=%s", user, bundle, bundle) |
There was a problem hiding this comment.
We need to investigate if the postgres client properly handles when the cert and key rotate (the default lifetime is 24 hours, but it can be lowered to 10 minutes for testing this).
There was a problem hiding this comment.
I added a live integration test that replaces the client cert bundles, server cert, and trust roots. It runs the tls-reload script and forces fresh connections.
I see that queries are succeeding with the replacements, cached TLS configurations are rejected, and an existing connection remains usable.
From what I can tell, the podcertificate API requires a minimum lifetime of 1 hour, not 10 minutes, unfortunately. So this test simulates the projected file replacement rather than waiting for kubelet renewal.
Summary
Part of: #2097
Part of: #2071
Bundled PostgreSQL currently accepts any client certificate signed by the pod-identity CA without binding it to the requested database username. Require certificate authentication with a common name matching the login, using a dedicated PostgreSQL client CA.
ate-systempods using theate-api-serverservice account. It issues only the two permitted identities:substrate_owner_userandsubstrate_readwrite_user.ate-setupprovision the CA and configure bundled PostgreSQL automatically, including on an existing installation. Disable passwords on the bundled application users and keep administrator access local to the PostgreSQL pod.External PostgreSQL and Cloud SQL continue to use their configured connection strings and authentication settings. Both application certificates are available to the API-server process; separate credentials preserve database role separation but do not isolate the roles from a compromised API server.
Validation
go test -race ./cmd/podcertcontroller/... ./cmd/ate-setup/... ./cmd/ateapi/internal/store/atepg ./pkg/postgressetup ./internal/installdefaultsafter rebasing onto updated main.