Skip to content

Commit 5c8c9d8

Browse files
tkcontianttkcontiant
committed
reoslve conflicts after rebase
1 parent 9f59a88 commit 5c8c9d8

File tree

7 files changed

+220
-27
lines changed

7 files changed

+220
-27
lines changed

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,7 @@ deploy/secret.yaml
3434
tests/kind-logs-*/
3535
kubeconfig
3636
/**/out
37-
out
37+
out
38+
39+
.gomodcache
40+
.gocache

‎api/v1alpha1/postgresuser_types.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,27 @@ type PostgresUserSpec struct {
1717
// +optional
1818
Privileges string `json:"privileges"`
1919
// +optional
20+
AWS *PostgresUserAWSSpec `json:"aws,omitempty"`
21+
// +optional
2022
Annotations map[string]string `json:"annotations,omitempty"`
2123
// +optional
2224
Labels map[string]string `json:"labels,omitempty"`
2325
}
2426

27+
// PostgresUserAWSSpec encapsulates AWS specific configuration toggles.
28+
type PostgresUserAWSSpec struct {
29+
// +optional
30+
EnableIamAuth bool `json:"enableIamAuth,omitempty"`
31+
}
32+
2533
// PostgresUserStatus defines the observed state of PostgresUser
2634
type PostgresUserStatus struct {
2735
Succeeded bool `json:"succeeded"`
2836
PostgresRole string `json:"postgresRole"`
2937
PostgresLogin string `json:"postgresLogin"`
3038
PostgresGroup string `json:"postgresGroup"`
3139
DatabaseName string `json:"databaseName"`
40+
EnableIamAuth bool `json:"enableIamAuth"`
3241
}
3342

3443
// +kubebuilder:object:root=true

‎charts/ext-postgres-operator/crds/db.movetokube.com_postgresusers_crd.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,29 @@ spec:
3535
additionalProperties:
3636
type: string
3737
type: object
38+
aws:
39+
description: AWS specific settings for the user
40+
properties:
41+
enableIamAuth:
42+
description: Enable IAM authentication for this user (PostgreSQL on AWS RDS only)
43+
default: false
44+
type: boolean
45+
type: object
3846
database:
47+
description: Name of the PostgresDatabase this user will be related to
3948
type: string
4049
labels:
4150
additionalProperties:
4251
type: string
4352
type: object
4453
privileges:
54+
description: List of privileges to grant to this user
4555
type: string
4656
role:
57+
description: Name of the PostgresRole this user will be associated with
4758
type: string
4859
secretName:
60+
description: Name of the secret to create with user credentials
4961
type: string
5062
secretTemplate:
5163
additionalProperties:
@@ -59,6 +71,9 @@ spec:
5971
status:
6072
description: PostgresUserStatus defines the observed state of PostgresUser
6173
properties:
74+
enableIamAuth:
75+
description: Reflects whether IAM authentication is enabled for this user.
76+
type: boolean
6277
databaseName:
6378
type: string
6479
postgresGroup:

‎config/crd/bases/db.movetokube.com_postgres.yaml‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,14 @@ spec:
2020
description: Postgres is the Schema for the postgres API
2121
properties:
2222
apiVersion:
23-
description: |-
24-
APIVersion defines the versioned schema of this representation of an object.
25-
Servers should convert recognized schemas to the latest internal value, and
26-
may reject unrecognized values.
27-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
23+
description: 'APIVersion defines the versioned schema of this representation
24+
of an object. Servers should convert recognized schemas to the latest
25+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2826
type: string
2927
kind:
30-
description: |-
31-
Kind is a string value representing the REST resource this object represents.
32-
Servers may infer this from the endpoint the client submits requests to.
33-
Cannot be updated.
34-
In CamelCase.
35-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
28+
description: 'Kind is a string value representing the REST resource this
29+
object represents. Servers may infer this from the endpoint the client
30+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3631
type: string
3732
metadata:
3833
type: object

‎config/crd/bases/db.movetokube.com_postgresusers.yaml‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,14 @@ spec:
2020
description: PostgresUser is the Schema for the postgresusers API
2121
properties:
2222
apiVersion:
23-
description: |-
24-
APIVersion defines the versioned schema of this representation of an object.
25-
Servers should convert recognized schemas to the latest internal value, and
26-
may reject unrecognized values.
27-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
23+
description: 'APIVersion defines the versioned schema of this representation
24+
of an object. Servers should convert recognized schemas to the latest
25+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2826
type: string
2927
kind:
30-
description: |-
31-
Kind is a string value representing the REST resource this object represents.
32-
Servers may infer this from the endpoint the client submits requests to.
33-
Cannot be updated.
34-
In CamelCase.
35-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
28+
description: 'Kind is a string value representing the REST resource this
29+
object represents. Servers may infer this from the endpoint the client
30+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3631
type: string
3732
metadata:
3833
type: object
@@ -43,17 +38,29 @@ spec:
4338
additionalProperties:
4439
type: string
4540
type: object
41+
aws:
42+
description: AWS specific settings for this user.
43+
properties:
44+
enableIamAuth:
45+
description: Enable IAM authentication for this user (PostgreSQL on AWS RDS only)
46+
default: false
47+
type: boolean
48+
type: object
4649
database:
50+
description: Name of the PostgresDatabase this user will be related to
4751
type: string
4852
labels:
4953
additionalProperties:
5054
type: string
5155
type: object
5256
privileges:
57+
description: List of privileges to grant to this user
5358
type: string
5459
role:
60+
description: Name of the PostgresRole this user will be associated with
5561
type: string
5662
secretName:
63+
description: Name of the secret to create with user credentials
5764
type: string
5865
secretTemplate:
5966
additionalProperties:
@@ -67,6 +74,9 @@ spec:
6774
status:
6875
description: PostgresUserStatus defines the observed state of PostgresUser
6976
properties:
77+
enableIamAuth:
78+
description: Reflects whether IAM authentication is enabled for this user.
79+
type: boolean
7080
databaseName:
7181
type: string
7282
postgresGroup:

‎internal/controller/postgresuser_controller.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ type PostgresUserReconciler struct {
3333
pgUriArgs string
3434
instanceFilter string
3535
keepSecretName bool // use secret name as defined in PostgresUserSpec
36+
cloudProvider string
3637
}
3738

3839
// NewPostgresUserReconciler returns a new reconcile.Reconciler
@@ -45,6 +46,7 @@ func NewPostgresUserReconciler(mgr manager.Manager, cfg *config.Cfg, pg postgres
4546
pgUriArgs: cfg.PostgresUriArgs,
4647
instanceFilter: cfg.AnnotationFilter,
4748
keepSecretName: cfg.KeepSecretName,
49+
cloudProvider: cfg.CloudProvider,
4850
}
4951
}
5052

@@ -228,6 +230,34 @@ func (r *PostgresUserReconciler) Reconcile(ctx context.Context, req ctrl.Request
228230
} else {
229231
role = instance.Status.PostgresRole
230232
login = instance.Status.PostgresLogin
233+
awsConfig := instance.Spec.AWS
234+
awsIamRequested := awsConfig != nil && awsConfig.EnableIamAuth
235+
236+
if r.cloudProvider == "AWS" {
237+
if awsIamRequested && !instance.Status.EnableIamAuth {
238+
if err := r.pg.GrantRole("rds_iam", role); err != nil {
239+
reqLogger.WithValues("role", role).Error(err, "failed to grant rds_iam role")
240+
} else {
241+
instance.Status.EnableIamAuth = true
242+
if sErr := r.Status().Update(ctx, instance); sErr != nil {
243+
reqLogger.WithValues("role", role).Error(sErr, "failed to update status after IAM grant")
244+
}
245+
}
246+
}
247+
248+
// Revoke aws_iam role on transition: spec=false, status=true
249+
if !awsIamRequested && instance.Status.EnableIamAuth {
250+
if err := r.pg.RevokeRole("rds_iam", role); err != nil {
251+
reqLogger.WithValues("role", role).Error(err, "failed to revoke rds_iam role")
252+
} else {
253+
instance.Status.EnableIamAuth = false
254+
if sErr := r.Status().Update(ctx, instance); sErr != nil {
255+
reqLogger.WithValues("role", role).Error(sErr, "failed to update status after IAM revoke")
256+
}
257+
}
258+
}
259+
} else if awsIamRequested {
260+
reqLogger.WithValues("role", role).Info("IAM Auth requested while we are not running with AWS cloud provider config")
231261
}
232262

233263
err = r.addFinalizer(ctx, reqLogger, instance)

‎internal/controller/postgresuser_controller_test.go‎

Lines changed: 135 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ var _ = Describe("PostgresUser Controller", func() {
2929
databaseName = "test-db"
3030
secretName = "db-credentials"
3131
roleName = "app"
32+
roleAws = "rds_iam"
3233
)
3334

3435
var (
@@ -98,10 +99,11 @@ var _ = Describe("PostgresUser Controller", func() {
9899
sc.AddKnownTypes(dbv1alpha1.GroupVersion, &dbv1alpha1.PostgresUserList{})
99100
// Create PostgresUserReconciler
100101
rp = &PostgresUserReconciler{
101-
Client: managerClient,
102-
Scheme: sc,
103-
pg: pg,
104-
pgHost: "postgres.local",
102+
Client: managerClient,
103+
Scheme: sc,
104+
pg: pg,
105+
pgHost: "postgres.local",
106+
cloudProvider: "AWS",
105107
}
106108
if k8sManager != nil {
107109
rp.SetupWithManager(k8sManager)
@@ -531,6 +533,135 @@ var _ = Describe("PostgresUser Controller", func() {
531533
})
532534
})
533535
})
536+
537+
Context("IAM authentication", func() {
538+
var (
539+
postgresDB *dbv1alpha1.Postgres
540+
postgresUser *dbv1alpha1.PostgresUser
541+
)
542+
543+
BeforeEach(func() {
544+
postgresDB = &dbv1alpha1.Postgres{
545+
ObjectMeta: metav1.ObjectMeta{
546+
Name: databaseName,
547+
Namespace: namespace,
548+
},
549+
Spec: dbv1alpha1.PostgresSpec{Database: databaseName},
550+
Status: dbv1alpha1.PostgresStatus{
551+
Succeeded: true,
552+
Roles: dbv1alpha1.PostgresRoles{
553+
Owner: databaseName + "-group",
554+
Reader: databaseName + "-reader",
555+
Writer: databaseName + "-writer",
556+
},
557+
},
558+
}
559+
560+
postgresUser = &dbv1alpha1.PostgresUser{
561+
ObjectMeta: metav1.ObjectMeta{
562+
Name: name,
563+
Namespace: namespace,
564+
},
565+
Spec: dbv1alpha1.PostgresUserSpec{
566+
Database: databaseName,
567+
SecretName: secretName,
568+
Role: roleName,
569+
Privileges: "WRITE",
570+
},
571+
}
572+
})
573+
574+
AfterEach(func() {
575+
// Clean up any created secrets
576+
secretList := &corev1.SecretList{}
577+
Expect(cl.List(ctx, secretList, client.InNamespace(namespace))).To(Succeed())
578+
for _, secret := range secretList.Items {
579+
Expect(cl.Delete(ctx, &secret)).To(Succeed())
580+
}
581+
})
582+
583+
It("grants rds_iam role when enableIamAuth is true", func() {
584+
// Create DB and user with IAM enabled
585+
initClient(postgresDB, nil, false)
586+
user := postgresUser.DeepCopy()
587+
user.Spec.AWS = &dbv1alpha1.PostgresUserAWSSpec{EnableIamAuth: true}
588+
Expect(cl.Create(ctx, user)).To(Succeed())
589+
590+
var capturedRole string
591+
pg.EXPECT().GetDefaultDatabase().Return("postgres").AnyTimes()
592+
pg.EXPECT().CreateUserRole(gomock.Any(), gomock.Any()).DoAndReturn(
593+
func(role, password string) (string, error) {
594+
Expect(role).To(HavePrefix(roleName + "-"))
595+
capturedRole = role
596+
return role, nil
597+
})
598+
pg.EXPECT().GrantRole(databaseName+"-writer", gomock.Any()).Return(nil)
599+
pg.EXPECT().AlterDefaultLoginRole(gomock.Any(), gomock.Any()).Return(nil)
600+
pg.EXPECT().GrantRole(roleAws, gomock.Any()).DoAndReturn(
601+
func(role, grantee string) error {
602+
Expect(role).To(Equal(roleAws))
603+
Expect(grantee).To(Equal(capturedRole))
604+
return nil
605+
})
606+
607+
err := runReconcile(rp, ctx, req)
608+
Expect(err).NotTo(HaveOccurred())
609+
610+
foundUser := &dbv1alpha1.PostgresUser{}
611+
err = cl.Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, foundUser)
612+
Expect(err).NotTo(HaveOccurred())
613+
Expect(foundUser.Status.EnableIamAuth).To(BeTrue())
614+
})
615+
616+
It("does not flip status on grant error", func() {
617+
initClient(postgresDB, nil, false)
618+
user := postgresUser.DeepCopy()
619+
user.Spec.AWS = &dbv1alpha1.PostgresUserAWSSpec{EnableIamAuth: true}
620+
Expect(cl.Create(ctx, user)).To(Succeed())
621+
622+
pg.EXPECT().GetDefaultDatabase().Return("postgres").AnyTimes()
623+
pg.EXPECT().CreateUserRole(gomock.Any(), gomock.Any()).Return(roleName+"-mock", nil)
624+
pg.EXPECT().GrantRole(databaseName+"-writer", gomock.Any()).Return(nil)
625+
pg.EXPECT().AlterDefaultLoginRole(gomock.Any(), gomock.Any()).Return(nil)
626+
pg.EXPECT().GrantRole(roleAws, gomock.Any()).Return(fmt.Errorf("grant failed"))
627+
628+
err := runReconcile(rp, ctx, req)
629+
Expect(err).NotTo(HaveOccurred())
630+
631+
foundUser := &dbv1alpha1.PostgresUser{}
632+
err = cl.Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, foundUser)
633+
Expect(err).NotTo(HaveOccurred())
634+
Expect(foundUser.Status.EnableIamAuth).To(BeFalse())
635+
})
636+
637+
It("revokes rds_iam role when enableIamAuth turns false", func() {
638+
// Pre-create a user with IAM already enabled in status
639+
user := postgresUser.DeepCopy()
640+
user.Spec.AWS = &dbv1alpha1.PostgresUserAWSSpec{EnableIamAuth: false}
641+
user.Status = dbv1alpha1.PostgresUserStatus{
642+
Succeeded: true,
643+
PostgresGroup: databaseName + "-writer",
644+
PostgresRole: roleName + "-exists",
645+
DatabaseName: databaseName,
646+
EnableIamAuth: true,
647+
PostgresLogin: "login",
648+
}
649+
initClient(postgresDB, user, false)
650+
651+
pg.EXPECT().RevokeRole(roleAws, roleName+"-exists").Return(nil)
652+
// Since Status.Succeeded=true and the secret does not yet exist, the reconciler
653+
// updates the password before creating the secret.
654+
pg.EXPECT().UpdatePassword(gomock.Any(), gomock.Any()).Return(nil)
655+
656+
err := runReconcile(rp, ctx, req)
657+
Expect(err).NotTo(HaveOccurred())
658+
659+
foundUser := &dbv1alpha1.PostgresUser{}
660+
err = cl.Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, foundUser)
661+
Expect(err).NotTo(HaveOccurred())
662+
Expect(foundUser.Status.EnableIamAuth).To(BeFalse())
663+
})
664+
})
534665
Context("Secret creation with user-defined labels and annotations", func() {
535666
It("should create a secret with user-defined labels and annotations", func() {
536667
// Set up the reconciler with host and keepSecretName setting

0 commit comments

Comments
 (0)