Switch to using /etc/pki/tls for the certificate source #32
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bdunne
changed the title
1 task
bdunne
changed the title
|
I hit the following issue when attempting to deploy with SSL enabled: This PR should fix the issue however, the current workaround is to create |
Fryguy
reviewed
Sep 22, 2023
container-assets/pre-start.sh
Outdated
Comment on lines
9
to
10
| # Postgresql server will reject key files with liberal permissions | ||
| chmod og-rwx /var/lib/pgsql/data/userdata/server.key |
The problem with /var/lib/pgsql/data/userdata is if this is a new install, initalizing the database will fail because the userdata directory is not empty and it is expected to be empty. Since the postgres configs are always mounted on the pod we need the certs to be in a predictable location.
Based on run-postgresql in v13 @ 481efd6
This needs to happen after generate_postgresql_config creates the ephemeral config file which includes all configs from mounted volumes so that these ssl settings are loaded last overwriting anything in included configs. It also needs to happen before try_pgupgrade could potentially try to start a server and before pg_ctl tries to start the server. We also need to ensure hostssl in pg_hba.conf after initialize_database in the case of a new empty volume.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No longer dependent on other PRs
Requires: ManageIQ/manageiq-pods#923Part of: ManageIQ/manageiq-pods#770