Skip to content

Commit 55315cc

Browse files
cbandycbandy
committed
Add an end-to-end test for PgBouncer TLS
Issue: [sc-13017]
1 parent e35722b commit 55315cc

14 files changed

+271
-23
lines changed

‎testing/kuttl/e2e/pgbouncer/00--cluster.yaml‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,20 @@
11
apiVersion: postgres-operator.crunchydata.com/v1beta1
22
kind: PostgresCluster
33
metadata:
4-
name: pgbouncer-test
4+
name: proxied
5+
labels: { postgres-operator-test: kuttl }
56
spec:
67
postgresVersion: 14
78
instances:
89
- name: instance1
910
replicas: 2
10-
dataVolumeClaimSpec:
11-
accessModes:
12-
- "ReadWriteOnce"
13-
resources:
14-
requests:
15-
storage: 1Gi
11+
dataVolumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }
1612
backups:
1713
pgbackrest:
1814
repos:
1915
- name: repo1
2016
volume:
21-
volumeClaimSpec:
22-
accessModes:
23-
- "ReadWriteOnce"
24-
resources:
25-
requests:
26-
storage: 1Gi
17+
volumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }
2718
proxy:
2819
pgBouncer:
2920
replicas: 1

‎testing/kuttl/e2e/pgbouncer/00-assert.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: postgres-operator.crunchydata.com/v1beta1
22
kind: PostgresCluster
33
metadata:
4-
name: pgbouncer-test
4+
name: proxied
55
status:
66
instances:
77
- name: instance1
@@ -12,4 +12,4 @@ status:
1212
apiVersion: v1
1313
kind: Service
1414
metadata:
15-
name: pgbouncer-test-pgbouncer
15+
name: proxied-pgbouncer

‎testing/kuttl/e2e/pgbouncer/01--psql-connect.yaml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,14 @@ apiVersion: batch/v1
22
kind: Job
33
metadata:
44
name: psql-connect
5+
labels: { postgres-operator-test: kuttl }
56
spec:
7+
backoffLimit: 3
68
template:
9+
metadata:
10+
labels: { postgres-operator-test: kuttl }
711
spec:
8-
backoffLimit: 3
9-
restartPolicy: "OnFailure"
12+
restartPolicy: Never
1013
containers:
1114
- name: psql
1215
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:centos8-14.1-0
@@ -20,19 +23,19 @@ spec:
2023
- name: PGSSLROOTCERT
2124
value: "/tmp/certs/ca.crt"
2225
- name: PGHOST
23-
valueFrom: { secretKeyRef: { name: pgbouncer-test-pguser-pgbouncer-test, key: pgbouncer-host } }
26+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-host } }
2427
- name: PGPORT
25-
valueFrom: { secretKeyRef: { name: pgbouncer-test-pguser-pgbouncer-test, key: pgbouncer-port } }
28+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-port } }
2629
- name: PGDATABASE
27-
valueFrom: { secretKeyRef: { name: pgbouncer-test-pguser-pgbouncer-test, key: dbname } }
30+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: dbname } }
2831
- name: PGUSER
29-
valueFrom: { secretKeyRef: { name: pgbouncer-test-pguser-pgbouncer-test, key: user } }
32+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: user } }
3033
- name: PGPASSWORD
31-
valueFrom: { secretKeyRef: { name: pgbouncer-test-pguser-pgbouncer-test, key: password } }
34+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: password } }
3235
volumeMounts:
3336
- name: certs
3437
mountPath: "/tmp/certs"
3538
volumes:
3639
- name: certs
3740
secret:
38-
secretName: pgbouncer-test-cluster-cert
41+
secretName: proxied-cluster-cert

‎testing/kuttl/e2e/pgbouncer/10--read-certificate.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
# Print the certificate presented by PgBouncer.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: read-cert-before
7+
labels: { postgres-operator-test: kuttl }
8+
spec:
9+
backoffLimit: 1
10+
template:
11+
metadata:
12+
labels: { postgres-operator-test: kuttl }
13+
spec:
14+
restartPolicy: Never
15+
containers:
16+
- name: openssl
17+
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:centos8-14.1-0
18+
env:
19+
- name: PGHOST
20+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-host } }
21+
- name: PGPORT
22+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-port } }
23+
command:
24+
- bash
25+
- -ceu
26+
- |
27+
openssl s_client --connect '$(PGHOST):$(PGPORT)' --starttls postgres < /dev/null 2> /dev/null |
28+
openssl x509 --noout --text

‎testing/kuttl/e2e/pgbouncer/10-assert.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
# Wait for the job to complete.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: read-cert-before
7+
status:
8+
succeeded: 1

‎testing/kuttl/e2e/pgbouncer/11--open-connection.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
# Connect through PgBouncer and wait long enough for TLS certificates to rotate.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: psql-open-connection
7+
labels: { postgres-operator-test: kuttl }
8+
spec:
9+
backoffLimit: 1
10+
template:
11+
metadata:
12+
labels: { postgres-operator-test: kuttl }
13+
spec:
14+
restartPolicy: Never
15+
volumes:
16+
# TODO(cbandy): Provide a CA bundle that clients can use for verification.
17+
- { name: tls, secret: { secretName: proxied-cluster-cert } }
18+
containers:
19+
- name: psql
20+
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:centos8-14.1-0
21+
env:
22+
# Connect through PgBouncer.
23+
- name: PGURI
24+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-uri } }
25+
26+
# Verify the certificate presented by PgBouncer.
27+
- { name: PGSSLMODE, value: verify-full }
28+
- { name: PGSSLROOTCERT, value: /mnt/ca.crt }
29+
30+
volumeMounts:
31+
- { name: tls, mountPath: /mnt }
32+
33+
command:
34+
- psql
35+
- $(PGURI)
36+
- -qAt
37+
- --set=ON_ERROR_STOP=1
38+
39+
# Print connection details.
40+
- --command=SELECT pid, backend_start FROM pg_stat_activity WHERE pid = pg_backend_pid();
41+
42+
# Wait here so later test steps can see this open connection.
43+
- --command=SELECT pg_sleep_for('5 minutes');

‎testing/kuttl/e2e/pgbouncer/11-assert.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
# Wait for the job to start.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: psql-open-connection
7+
status:
8+
active: 1
9+
10+
---
11+
# Wait for the pod to start.
12+
apiVersion: v1
13+
kind: Pod
14+
metadata:
15+
labels:
16+
job-name: psql-open-connection
17+
status:
18+
phase: Running

‎testing/kuttl/e2e/pgbouncer/12--rotate-certificate.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
- script: |
6+
BEFORE=$(date -u +%FT%TZ)
7+
8+
# Wipe out the stored PgBouncer certificate.
9+
kubectl patch --namespace "${NAMESPACE}" secret/proxied-pgbouncer \
10+
--patch '{"data":{"pgbouncer-frontend.crt":""}}'
11+
12+
# Wait for the certificate to be regenerated then loaded.
13+
until
14+
kubectl logs --namespace "${NAMESPACE}" deployment.apps/proxied-pgbouncer \
15+
--container pgbouncer-config --since-time "${BEFORE}" | grep 'Loaded'
16+
do
17+
sleep 1
18+
done

‎testing/kuttl/e2e/pgbouncer/13--read-certificate.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
# Print the certificate presented by PgBouncer.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: read-cert-after
7+
labels: { postgres-operator-test: kuttl }
8+
spec:
9+
backoffLimit: 1
10+
template:
11+
metadata:
12+
labels: { postgres-operator-test: kuttl }
13+
spec:
14+
restartPolicy: Never
15+
containers:
16+
- name: openssl
17+
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:centos8-14.1-0
18+
env:
19+
- name: PGHOST
20+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-host } }
21+
- name: PGPORT
22+
valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-port } }
23+
command:
24+
- bash
25+
- -ceu
26+
- |
27+
openssl s_client --connect '$(PGHOST):$(PGPORT)' --starttls postgres < /dev/null 2> /dev/null |
28+
openssl x509 --noout --text

‎testing/kuttl/e2e/pgbouncer/13-assert.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
# Wait for the job to complete.
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: read-cert-after
7+
status:
8+
succeeded: 1

0 commit comments

Comments
 (0)