From 0b2420b6b80dbf931cccf53d4bc04bfe4c60396d Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Fri, 14 Nov 2025 11:07:20 +0100 Subject: [PATCH] Fix support PostgreSQL CA bundle in Helm charts with file path option Signed-off-by: Bryan Frimin --- contrib/helm/charts/probo/README.md | 39 +++++++++++++++++++ .../charts/probo/templates/deployment.yaml | 10 +++++ .../helm/charts/probo/templates/secret.yaml | 3 ++ contrib/helm/charts/probo/values.yaml | 7 ++++ docs/CONFIGURATION.md | 14 +++++++ entrypoint.sh | 17 +++++--- 6 files changed, 84 insertions(+), 6 deletions(-) diff --git a/contrib/helm/charts/probo/README.md b/contrib/helm/charts/probo/README.md index bb47f8b5c..e0b2ccfac 100644 --- a/contrib/helm/charts/probo/README.md +++ b/contrib/helm/charts/probo/README.md @@ -155,6 +155,8 @@ The following parameters **must** be configured: | `postgresql.port` | PostgreSQL port | `5432` | | `postgresql.database` | Database name | `probod` | | `postgresql.username` | Database user | `probod` | +| `postgresql.caBundle` | PostgreSQL TLS CA certificate bundle (inline) | `""` | +| `postgresql.caBundlePath` | PostgreSQL TLS CA certificate bundle (file path) | `""` | | `s3.bucket` | S3 bucket name | `probod` | | `s3.region` | AWS region | `us-east-1` | | `s3.endpoint` | S3 endpoint (for S3-compatible) | `""` | @@ -183,6 +185,38 @@ The chart deploys the following: Database migrations run automatically when Probo starts. No manual intervention is required. +### TLS/SSL Configuration + +For secure PostgreSQL connections, you can provide a CA certificate bundle in two ways: + +1. **Inline CA Bundle** (`postgresql.caBundle`): Provide the certificate content directly in values.yaml + ```yaml + postgresql: + caBundle: | + -----BEGIN CERTIFICATE----- + MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl + ... + -----END CERTIFICATE----- + ``` + +2. **File Path** (`postgresql.caBundlePath`): Mount the CA bundle as a ConfigMap/Secret and reference the path + ```yaml + postgresql: + caBundlePath: /etc/ssl/certs/ca-certificates.crt + + # Then mount your CA bundle using volumes/volumeMounts + volumes: + - name: ca-bundle + configMap: + name: postgres-ca-bundle + volumeMounts: + - name: ca-bundle + mountPath: /etc/ssl/certs + readOnly: true + ``` + +**Note:** Using `caBundlePath` is recommended for large CA bundles (e.g., system CA bundles) as it avoids environment variable size limitations. + ### Backup Use your PostgreSQL provider's backup solution (e.g., AWS RDS automated backups, GCP Cloud SQL backups). @@ -232,6 +266,11 @@ Check the Probo logs for S3 connection errors when uploading files. postgresql: host: "mydb.abc123.us-east-1.rds.amazonaws.com" password: "" + # Optional: Add RDS CA bundle for TLS connections + # caBundle: | + # -----BEGIN CERTIFICATE----- + # ...RDS CA certificate... + # -----END CERTIFICATE----- s3: region: "us-east-1" diff --git a/contrib/helm/charts/probo/templates/deployment.yaml b/contrib/helm/charts/probo/templates/deployment.yaml index 15b9edd67..a66755c1e 100644 --- a/contrib/helm/charts/probo/templates/deployment.yaml +++ b/contrib/helm/charts/probo/templates/deployment.yaml @@ -85,6 +85,16 @@ spec: value: {{ include "probo.postgresql.database" . | quote }} - name: PG_POOL_SIZE value: {{ .Values.postgresql.poolSize | default "100" | quote }} + {{- if .Values.postgresql.caBundle }} + - name: PG_CA_BUNDLE + valueFrom: + secretKeyRef: + name: {{ include "probo.fullname" . }} + key: pg-ca-bundle + {{- else if .Values.postgresql.caBundlePath }} + - name: PG_CA_BUNDLE_PATH + value: {{ .Values.postgresql.caBundlePath | quote }} + {{- end }} # Authentication - name: AUTH_DISABLE_SIGNUP value: {{ .Values.probo.auth.disableSignup | quote }} diff --git a/contrib/helm/charts/probo/templates/secret.yaml b/contrib/helm/charts/probo/templates/secret.yaml index 736ed2612..0cbcb10f7 100644 --- a/contrib/helm/charts/probo/templates/secret.yaml +++ b/contrib/helm/charts/probo/templates/secret.yaml @@ -8,6 +8,9 @@ type: Opaque stringData: # Database credentials db-password: {{ if .Values.postgresql.enabled }}{{ .Values.postgresql.auth.postgresPassword | quote }}{{ else }}{{ required "postgresql.password is required when postgresql.enabled=false" .Values.postgresql.password | quote }}{{ end }} + {{- if .Values.postgresql.caBundle }} + pg-ca-bundle: {{ .Values.postgresql.caBundle | quote }} + {{- end }} # S3 credentials s3-access-key: {{ include "probo.s3.accessKeyId" . | quote }} diff --git a/contrib/helm/charts/probo/values.yaml b/contrib/helm/charts/probo/values.yaml index 372317454..8c9e77006 100644 --- a/contrib/helm/charts/probo/values.yaml +++ b/contrib/helm/charts/probo/values.yaml @@ -297,6 +297,13 @@ postgresql: password: "" # REQUIRED when enabled=false: PostgreSQL password database: probod poolSize: 100 + # PostgreSQL TLS/SSL configuration + # caBundle: | + # -----BEGIN CERTIFICATE----- + # ...certificate content... + # -----END CERTIFICATE----- + # Or use caBundlePath to mount from a ConfigMap/Secret + # caBundlePath: /etc/ssl/certs/ca-certificates.crt # S3 storage configuration # For production: Use external S3 (AWS S3, GCS, etc.) diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md index d1e87b9e1..bbcc93fd6 100644 --- a/docs/CONFIGURATION.md +++ b/docs/CONFIGURATION.md @@ -325,6 +325,20 @@ Maximum number of database connections in the connection pool. PEM-encoded CA certificate bundle for TLS database connections. Required when connecting to databases with custom or self-signed certificates. +**Environment Variable Options:** + +- `PG_CA_BUNDLE`: Provide the CA bundle content directly as an environment variable (suitable for smaller bundles) +- `PG_CA_BUNDLE_PATH`: Provide a file path to the CA bundle (recommended for large CA bundles to avoid "Argument list too long" errors) + +**Example using file path:** +```yaml +# docker-compose.yml or Kubernetes deployment +environment: + PG_CA_BUNDLE_PATH: /etc/ssl/certs/ca-certificates.crt +``` + +**Note:** When using `PG_CA_BUNDLE_PATH`, the file is read during configuration generation, avoiding environment size limitations. This is the recommended approach when using system CA bundles or large certificate collections. + ### Authentication Configuration #### `auth.disable-signup` (boolean) diff --git a/entrypoint.sh b/entrypoint.sh index cb82808b6..5c6703d6e 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -27,12 +27,12 @@ generate_saml_defaults() { fi } -# Function to load CA bundle from file or environment variable -load_pg_ca_bundle() { +# Function to validate CA bundle path +validate_pg_ca_bundle_path() { if [ -n "$PG_CA_BUNDLE_PATH" ]; then if [ -f "$PG_CA_BUNDLE_PATH" ]; then echo "Loading PostgreSQL CA bundle from: $PG_CA_BUNDLE_PATH" - export PG_CA_BUNDLE=$(cat "$PG_CA_BUNDLE_PATH") + export PG_CA_BUNDLE_FILE="$PG_CA_BUNDLE_PATH" else echo "Warning: PG_CA_BUNDLE_PATH specified but file not found: $PG_CA_BUNDLE_PATH" fi @@ -48,8 +48,8 @@ else # Generate default SAML credentials if not provided generate_saml_defaults - # Load PostgreSQL CA bundle if configured - load_pg_ca_bundle + # Validate PostgreSQL CA bundle path if configured + validate_pg_ca_bundle_path # Create directory if it doesn't exist mkdir -p "$(dirname "$CONFIG_FILE")" @@ -85,7 +85,12 @@ probod: EOF # Add PostgreSQL CA bundle if configured - if [ -n "$PG_CA_BUNDLE" ]; then + if [ -n "$PG_CA_BUNDLE_FILE" ]; then + cat >> "$CONFIG_FILE" <> "$CONFIG_FILE" <