Skip to content

Commit bf24060

Browse files
tjmoore4tjmoore4
committed
Remove TDE/Hardened support code
Issue: PGO-2811
1 parent 91a1c6c commit bf24060

File tree

13 files changed

+13
-363
lines changed

13 files changed

+13
-363
lines changed

‎internal/config/config.go‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -19,32 +19,6 @@ func defaultFromEnv(value, key string) string {
1919
return value
2020
}
2121

22-
// FetchKeyCommand returns the fetch_key_cmd value stored in the encryption_key_command
23-
// variable used to enable TDE.
24-
func FetchKeyCommand(spec *v1beta1.PostgresClusterSpec) string {
25-
if config := spec.Config; config != nil {
26-
if parameters := config.Parameters; parameters != nil {
27-
if v, ok := parameters["encryption_key_command"]; ok {
28-
return v.String()
29-
}
30-
}
31-
}
32-
33-
if spec.Patroni != nil {
34-
if configuration := spec.Patroni.DynamicConfiguration; configuration != nil {
35-
if postgresql, ok := configuration["postgresql"].(map[string]any); ok {
36-
if parameters, ok := postgresql["parameters"].(map[string]any); ok {
37-
if parameters["encryption_key_command"] != nil {
38-
return fmt.Sprintf("%s", parameters["encryption_key_command"])
39-
}
40-
}
41-
}
42-
}
43-
}
44-
45-
return ""
46-
}
47-
4822
// Red Hat Marketplace requires operators to use environment variables be used
4923
// for any image other than the operator itself. Those variables must start with
5024
// "RELATED_IMAGE_" so that OSBS can transform their tag values into digests

‎internal/config/config_test.go‎

Lines changed: 0 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -14,118 +14,6 @@ import (
1414
"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
1515
)
1616

17-
func TestFetchKeyCommand(t *testing.T) {
18-
t.Run("missing", func(t *testing.T) {
19-
spec1 := v1beta1.PostgresClusterSpec{}
20-
assert.Assert(t, FetchKeyCommand(&spec1) == "")
21-
22-
spec2 := v1beta1.PostgresClusterSpec{
23-
Patroni: &v1beta1.PatroniSpec{},
24-
}
25-
assert.Assert(t, FetchKeyCommand(&spec2) == "")
26-
27-
spec3 := v1beta1.PostgresClusterSpec{
28-
Patroni: &v1beta1.PatroniSpec{
29-
DynamicConfiguration: map[string]any{},
30-
},
31-
}
32-
assert.Assert(t, FetchKeyCommand(&spec3) == "")
33-
34-
spec4 := v1beta1.PostgresClusterSpec{
35-
Patroni: &v1beta1.PatroniSpec{
36-
DynamicConfiguration: map[string]any{
37-
"postgresql": map[string]any{},
38-
},
39-
},
40-
}
41-
assert.Assert(t, FetchKeyCommand(&spec4) == "")
42-
43-
spec5 := v1beta1.PostgresClusterSpec{
44-
Patroni: &v1beta1.PatroniSpec{
45-
DynamicConfiguration: map[string]any{
46-
"postgresql": map[string]any{
47-
"parameters": map[string]any{},
48-
},
49-
},
50-
},
51-
}
52-
assert.Assert(t, FetchKeyCommand(&spec5) == "")
53-
})
54-
55-
t.Run("blank", func(t *testing.T) {
56-
var spec1 v1beta1.PostgresClusterSpec
57-
require.UnmarshalInto(t, &spec1, `{
58-
patroni: {
59-
dynamicConfiguration: {
60-
postgresql: {
61-
parameters: {
62-
encryption_key_command: "",
63-
},
64-
},
65-
},
66-
},
67-
}`)
68-
assert.Equal(t, "", FetchKeyCommand(&spec1))
69-
70-
var spec2 v1beta1.PostgresClusterSpec
71-
require.UnmarshalInto(t, &spec2, `{
72-
config: {
73-
parameters: {
74-
encryption_key_command: "",
75-
},
76-
},
77-
}`)
78-
assert.Equal(t, "", FetchKeyCommand(&spec2))
79-
})
80-
81-
t.Run("exists", func(t *testing.T) {
82-
var spec1 v1beta1.PostgresClusterSpec
83-
require.UnmarshalInto(t, &spec1, `{
84-
patroni: {
85-
dynamicConfiguration: {
86-
postgresql: {
87-
parameters: {
88-
encryption_key_command: "echo mykey",
89-
},
90-
},
91-
},
92-
},
93-
}`)
94-
assert.Equal(t, "echo mykey", FetchKeyCommand(&spec1))
95-
96-
var spec2 v1beta1.PostgresClusterSpec
97-
require.UnmarshalInto(t, &spec2, `{
98-
config: {
99-
parameters: {
100-
encryption_key_command: "cat somefile",
101-
},
102-
},
103-
}`)
104-
assert.Equal(t, "cat somefile", FetchKeyCommand(&spec2))
105-
})
106-
107-
t.Run("config.parameters takes precedence", func(t *testing.T) {
108-
var spec v1beta1.PostgresClusterSpec
109-
require.UnmarshalInto(t, &spec, `{
110-
config: {
111-
parameters: {
112-
encryption_key_command: "cat somefile",
113-
},
114-
},
115-
patroni: {
116-
dynamicConfiguration: {
117-
postgresql: {
118-
parameters: {
119-
encryption_key_command: "echo mykey",
120-
},
121-
},
122-
},
123-
},
124-
}`)
125-
assert.Equal(t, "cat somefile", FetchKeyCommand(&spec))
126-
})
127-
}
128-
12917
func TestPGAdminContainerImage(t *testing.T) {
13018
cluster := &v1beta1.PostgresCluster{}
13119

‎internal/controller/pgupgrade/jobs.go‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"github.com/crunchydata/postgres-operator/internal/initialize"
2323
"github.com/crunchydata/postgres-operator/internal/naming"
2424
"github.com/crunchydata/postgres-operator/internal/postgres"
25-
"github.com/crunchydata/postgres-operator/internal/shell"
2625
"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
2726
)
2827

@@ -37,7 +36,7 @@ func pgUpgradeJob(upgrade *v1beta1.PGUpgrade) metav1.ObjectMeta {
3736

3837
// upgradeCommand returns an entrypoint that prepares the filesystem for
3938
// and performs a PostgreSQL major version upgrade using pg_upgrade.
40-
func upgradeCommand(spec *v1beta1.PGUpgradeSettings, fetchKeyCommand string) []string {
39+
func upgradeCommand(spec *v1beta1.PGUpgradeSettings) []string {
4140
argJobs := fmt.Sprintf(` --jobs=%d`, max(1, spec.Jobs))
4241
argMethod := cmp.Or(map[string]string{
4342
"Clone": ` --clone`,
@@ -48,11 +47,6 @@ func upgradeCommand(spec *v1beta1.PGUpgradeSettings, fetchKeyCommand string) []s
4847
oldVersion := spec.FromPostgresVersion
4948
newVersion := spec.ToPostgresVersion
5049

51-
var argEncryptionKeyCommand string
52-
if fetchKeyCommand != "" {
53-
argEncryptionKeyCommand = ` --encryption-key-command=` + shell.QuoteWord(fetchKeyCommand)
54-
}
55-
5650
args := []string{fmt.Sprint(oldVersion), fmt.Sprint(newVersion)}
5751
script := strings.Join([]string{
5852
// Exit immediately when a pipeline or subshell exits non-zero or when expanding an unset variable.
@@ -138,7 +132,7 @@ func upgradeCommand(spec *v1beta1.PGUpgradeSettings, fetchKeyCommand string) []s
138132
`checksums=$(if [[ "${checksums}" -gt 0 ]]; then echo '--data-checksums'; elif [[ "${new_version}" -ge 18 ]]; then echo '--no-data-checksums'; fi)`,
139133

140134
`section 'Step 3 of 7: Initializing new data directory...'`,
141-
`PGDATA="${new_data}" "${new_bin}/initdb" --allow-group-access ${checksums}` + argEncryptionKeyCommand,
135+
`PGDATA="${new_data}" "${new_bin}/initdb" --allow-group-access ${checksums}`,
142136

143137
// Read the configured value then quote it; every single-quote U+0027 is replaced by two.
144138
//
@@ -186,8 +180,7 @@ func largestWholeCPU(resources corev1.ResourceRequirements) int64 {
186180
// directory of the startup instance.
187181
func (r *PGUpgradeReconciler) generateUpgradeJob(
188182
ctx context.Context, upgrade *v1beta1.PGUpgrade,
189-
startup *appsv1.StatefulSet, fetchKeyCommand string,
190-
) *batchv1.Job {
183+
startup *appsv1.StatefulSet) *batchv1.Job {
191184
job := &batchv1.Job{}
192185
job.SetGroupVersionKind(batchv1.SchemeGroupVersion.WithKind("Job"))
193186

@@ -252,7 +245,7 @@ func (r *PGUpgradeReconciler) generateUpgradeJob(
252245
VolumeMounts: database.VolumeMounts,
253246

254247
// Use our upgrade command and the specified image and resources.
255-
Command: upgradeCommand(settings, fetchKeyCommand),
248+
Command: upgradeCommand(settings),
256249
Image: pgUpgradeContainerImage(upgrade),
257250
ImagePullPolicy: upgrade.Spec.ImagePullPolicy,
258251
Resources: upgrade.Spec.Resources,

‎internal/controller/pgupgrade/jobs_test.go‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ func TestUpgradeCommand(t *testing.T) {
8585
{Spec: 10, Args: "--jobs=10"},
8686
} {
8787
spec := &v1beta1.PGUpgradeSettings{Jobs: tt.Spec}
88-
command := upgradeCommand(spec, "")
88+
command := upgradeCommand(spec)
8989
assert.Assert(t, len(command) > 3)
9090
assert.DeepEqual(t, []string{"bash", "-c", "--"}, command[:3])
9191

@@ -109,7 +109,7 @@ func TestUpgradeCommand(t *testing.T) {
109109
{Spec: "CopyFileRange", Args: "--copy-file-range"},
110110
} {
111111
spec := &v1beta1.PGUpgradeSettings{TransferMethod: tt.Spec}
112-
command := upgradeCommand(spec, "")
112+
command := upgradeCommand(spec)
113113
assert.Assert(t, len(command) > 3)
114114
assert.DeepEqual(t, []string{"bash", "-c", "--"}, command[:3])
115115

@@ -158,7 +158,7 @@ func TestGenerateUpgradeJob(t *testing.T) {
158158
},
159159
}
160160

161-
job := reconciler.generateUpgradeJob(ctx, upgrade, startup, "")
161+
job := reconciler.generateUpgradeJob(ctx, upgrade, startup)
162162
assert.Assert(t, cmp.MarshalMatches(job, `
163163
apiVersion: batch/v1
164164
kind: Job
@@ -267,13 +267,9 @@ status: {}
267267
}))
268268
ctx := feature.NewContext(context.Background(), gate)
269269

270-
job := reconciler.generateUpgradeJob(ctx, upgrade, startup, "")
270+
job := reconciler.generateUpgradeJob(ctx, upgrade, startup)
271271
assert.Assert(t, cmp.MarshalContains(job, `--jobs=2`))
272272
})
273-
274-
tdeJob := reconciler.generateUpgradeJob(ctx, upgrade, startup, "echo testKey")
275-
assert.Assert(t, cmp.MarshalContains(tdeJob,
276-
`PGDATA="${new_data}" "${new_bin}/initdb" --allow-group-access ${checksums} --encryption-key-command='echo testKey'`))
277273
}
278274

279275
func TestGenerateRemoveDataJob(t *testing.T) {

‎internal/controller/pgupgrade/pgupgrade_controller.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"sigs.k8s.io/controller-runtime/pkg/handler"
2020
"sigs.k8s.io/controller-runtime/pkg/reconcile"
2121

22-
"github.com/crunchydata/postgres-operator/internal/config"
2322
"github.com/crunchydata/postgres-operator/internal/controller/runtime"
2423
"github.com/crunchydata/postgres-operator/internal/logging"
2524
"github.com/crunchydata/postgres-operator/internal/naming"
@@ -431,7 +430,7 @@ func (r *PGUpgradeReconciler) Reconcile(ctx context.Context, upgrade *v1beta1.PG
431430
// TODO: error from apply could mean that the job exists with a different spec.
432431
if err == nil && !upgradeJobComplete {
433432
err = errors.WithStack(runtime.Apply(ctx, r.Writer,
434-
r.generateUpgradeJob(ctx, upgrade, world.ClusterPrimary, config.FetchKeyCommand(&world.Cluster.Spec))))
433+
r.generateUpgradeJob(ctx, upgrade, world.ClusterPrimary)))
435434
}
436435

437436
// Create the jobs to remove the data from the replicas, as long as

‎internal/controller/postgrescluster/pgbackrest.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1262,9 +1262,6 @@ func (r *Reconciler) reconcileRestoreJob(ctx context.Context,
12621262

12631263
params := postgres.NewParameterSet()
12641264
postgres.SetHugePages(cluster, params)
1265-
if fetchKeyCommand := config.FetchKeyCommand(&cluster.Spec); fetchKeyCommand != "" {
1266-
params.Add("encryption_key_command", fetchKeyCommand)
1267-
}
12681265

12691266
// NOTE (andrewlecuyer): Forcing users to put each argument separately might prevent the need
12701267
// to do any escaping or use eval.

‎internal/patroni/config.go‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
corev1 "k8s.io/api/core/v1"
1414
"sigs.k8s.io/yaml"
1515

16-
"github.com/crunchydata/postgres-operator/internal/config"
1716
"github.com/crunchydata/postgres-operator/internal/initialize"
1817
"github.com/crunchydata/postgres-operator/internal/naming"
1918
"github.com/crunchydata/postgres-operator/internal/postgres"
@@ -228,14 +227,6 @@ func DynamicConfiguration(
228227
"use_slots": false,
229228
}
230229

231-
// When TDE is configured, override the pg_rewind binary name to point
232-
// to the wrapper script.
233-
if config.FetchKeyCommand(spec) != "" {
234-
postgresql["bin_name"] = map[string]any{
235-
"pg_rewind": "/tmp/pg_rewind_tde.sh",
236-
}
237-
}
238-
239230
// Copy the "postgresql" section over the above defaults.
240231
if section, ok := root["postgresql"].(map[string]any); ok {
241232
maps.Copy(postgresql, section)
@@ -575,11 +566,6 @@ func instanceYAML(
575566
"waldir=" + postgres.WALDirectory(cluster, instance),
576567
}
577568

578-
// Append the encryption key command, if provided.
579-
if ekc := config.FetchKeyCommand(&cluster.Spec); ekc != "" {
580-
initdb = append(initdb, fmt.Sprintf("encryption-key-command=%s", ekc))
581-
}
582-
583569
// Populate some "bootstrap" fields to initialize the cluster.
584570
// When Patroni is already bootstrapped, this section is ignored.
585571
// - https://github.com/zalando/patroni/blob/v2.0.2/docs/SETTINGS.rst#bootstrap-configuration

‎internal/patroni/config_test.go‎

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -525,31 +525,6 @@ func TestDynamicConfiguration(t *testing.T) {
525525
},
526526
},
527527
},
528-
{
529-
name: "config.parameters: tde enabled",
530-
spec: `{
531-
config: {
532-
parameters: {
533-
encryption_key_command: echo one,
534-
},
535-
},
536-
}`,
537-
params: parameters(map[string]string{
538-
"encryption_key_command": "echo one",
539-
}),
540-
expected: map[string]any{
541-
"loop_wait": int32(10),
542-
"ttl": int32(30),
543-
"postgresql": map[string]any{
544-
"bin_name": map[string]any{"pg_rewind": string("/tmp/pg_rewind_tde.sh")},
545-
"parameters": map[string]string{
546-
"encryption_key_command": "echo one",
547-
},
548-
"use_pg_rewind": bool(true),
549-
"use_slots": bool(false),
550-
},
551-
},
552-
},
553528
} {
554529
t.Run(tt.name, func(t *testing.T) {
555530
cluster := new(v1beta1.PostgresCluster)
@@ -729,41 +704,6 @@ postgresql:
729704
pgpass: /tmp/.pgpass
730705
use_unix_socket: true
731706
restapi: {}
732-
tags: {}
733-
`, "\t\n")+"\n")
734-
735-
cluster.Spec.Patroni = &v1beta1.PatroniSpec{
736-
DynamicConfiguration: map[string]any{
737-
"postgresql": map[string]any{
738-
"parameters": map[string]any{
739-
"encryption_key_command": "echo test",
740-
},
741-
},
742-
},
743-
}
744-
745-
datawithTDE, err := instanceYAML(cluster, instance, nil)
746-
assert.NilError(t, err)
747-
assert.Equal(t, datawithTDE, strings.Trim(`
748-
# Generated by postgres-operator. DO NOT EDIT.
749-
# Your changes will not be saved.
750-
bootstrap:
751-
initdb:
752-
- allow-group-access
753-
- data-checksums
754-
- encoding=UTF8
755-
- waldir=/pgdata/pg12_wal
756-
- encryption-key-command=echo test
757-
method: initdb
758-
kubernetes: {}
759-
postgresql:
760-
basebackup:
761-
- waldir=/pgdata/pg12_wal
762-
create_replica_methods:
763-
- basebackup
764-
pgpass: /tmp/.pgpass
765-
use_unix_socket: true
766-
restapi: {}
767707
tags: {}
768708
`, "\t\n")+"\n")
769709

0 commit comments

Comments
 (0)