[Feature]: Configurable PgBouncer TLS cipher parameters #9570

Is there an existing issue already for this feature request/idea?

• I have searched for an existing issue, and could not find anything. I believe this is a new feature request to be evaluated.

What problem is this feature going to solve? Why should it be added?

This feature addresses the lack of fine-grained control over TLS cipher selection in PgBouncer. Currently, users cannot explicitly configure which TLS ciphers are permitted for client and server connections, which makes it difficult to enforce organizational security policies, comply with regulatory requirements, or quickly respond to newly discovered cryptographic weaknesses.

Adding configurable TLS cipher parameters (client_tls_ciphers, client_tls13_ciphers, and server_tls13_ciphers) would give operators direct control over cipher negotiation, improving security posture and operational flexibility. This is particularly important in environments with strict compliance or hardened security baselines.

TLS v1.3 specific configuration options were introduced in PgBouncer v1.25.0 (ref: https://www.pgbouncer.org/changelog.html#pgbouncer-125x), so extending configuration to explicitly control cipher suites is a natural and consistent evolution of the existing TLS feature set.

Describe the solution you'd like

Extend the AllowedPgbouncerGenericConfigurationParameters string set to include client_tls_ciphers, client_tls13_ciphers, and server_tls13_ciphers, allowing these TLS cipher configuration options to be passed through and managed explicitly in PgBouncer.

Describe alternatives you've considered

No viable alternatives were considered, because the webhook currently rejects any attempt to set these options, making it impossible to configure TLS cipher parameters through other means.

Additional context

No response

Backport?

N/A

Are you willing to actively contribute to this feature?

Yes

Code of Conduct

• I agree to follow this project's Code of Conduct