Database SSL Mode `verify-ca` or `verify-full` with a custom CA certificate

[iainsproat]

Expected Behavior

Given a custom root CA certificate for a postgres database server, I would like postgres to use verify-ca or verify-full SSL modes using the custom CA certificate.

Is there a mechanism for achieving this that maybe I have missed?

Actual Behavior

With the existing kubernetes manifests, there does not seem to be a mechanism for mounting a trusted certificate either in postgres default location or by specifying a custom location to postgres.

Steps to Reproduce the Problem

1. Configure Results with either DB_SSLMODE=verify-ca or DB_SSLMODE=verify-full.
2. Provide a trusted certificate to Results to be used by postgres.
3. Results API should undertake SSL verification using the trusted certificate when connecting, but does not.

Additional Info

• Kubernetes version:

  Output of kubectl version:

  (paste your output here)

• Tekton Pipeline version:

  Output of tkn version or kubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'

[xinnjie]

There is no mechanism for achieving this currently IMO.

This should be a feature request.

[adambkaplan]

/kind feature

Agree this would be a net new feature, as Results would need to do the following:

1. Provide a means for the database certificate authority (CA) to be (optionally) mounted at a known path in the apiserver deployment.
2. Ensure that the path to the database CA is passed into the Postgres connection string, via the sslrootcert parameter.

See PostgreSQL SSL docs for further technical information.

[tekton-robot]

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale with a justification. Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with /close with a justification. If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[adambkaplan]

/lifecycle frozen

This is an important security feature.

[enarha]

/assign enarha

[enarha]

@iainsproat, when you have a chance please TAL at #658. It implements the feature you asked for. Thanks.