From 7dc4b6d05b687f0044d05da096469bb64bf9f5a8 Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Fri, 14 Aug 2026 18:13:58 +0600 Subject: [PATCH] Support user-supplied pg_hba rules via configSecret key user_hba.conf pg_hba.conf is regenerated from scratch by these scripts on every pod start, so users have had no way to add authentication rules -- and because pg_hba.conf is first-match-wins, appending rules at the end (the natural analogue of postgresql.conf's trailing include_if_exists, which is last-wins) would leave them dead behind the generated "host all all 0.0.0.0/0" catch-alls. Instead, rules from /etc/config/user_hba.conf (projected by the operator from the Postgres configSecret) are injected into every generation branch at a fixed position: after the local/loopback and loopback-replication rules the operator's own scripts and sidecars depend on, and before the world-CIDR catch-alls. User rules can therefore override the catch-alls (e.g. reject the postgres role from outside the pod network) but cannot lock the operator out of the unix socket or loopback. The mechanism is version-gated, verified empirically on both paths: * PostgreSQL >= 16 emits include_if_exists "/etc/config/user_hba.conf" so a secret update takes effect on pg_reload_conf() with no restart, mirroring how user.conf already behaves for GUCs. A missing file is tolerated at startup and reload. The path is double-quoted deliberately: a single-quoted token is treated as a literal filename (quotes included) and include_if_exists then skips it silently. * PostgreSQL <= 15 has no include support in pg_hba.conf -- a include line is FATAL at startup ("could not load pg_hba.conf"). The file content is copied in at generation time instead, so changes take effect on pod restart. Only long-running server paths are changed: primary/start.sh, standby/run.sh and standby/remote-replica.sh. warm_stanby.sh, ha_backup_job.sh and restore.sh also generate pg_hba.conf but run postgres only for seconds during bootstrap/restore with local access; injecting user rules there risks breaking recovery for no security gain. Verified with a harness that executes the generation section of every modified script and its master counterpart under all five SSL/CLIENT_AUTH_MODE combinations, with and without the user file (260 checks): without the file, <= 15 output is byte-identical to master and >= 16 differs by exactly the include line; with the file, the rules appear exactly once, after the essentials and before the first catch-all, in every branch. Note for users: rules targeting the postgres role over the pod network can break HA -- pg-coordinator connects to peer pods as postgres with replication=database, which matches ordinary host rules, not the replication keyword. Restricting postgres to the pod CIDR before a wider reject is the safe pattern; the docs guide carries the recipe. Signed-off-by: Tamal Saha --- role_scripts/10/primary/start.sh | 33 ++++++++++++++ role_scripts/10/standby/run.sh | 33 ++++++++++++++ role_scripts/11/primary/start.sh | 55 +++++++++++++++++++++++ role_scripts/11/standby/run.sh | 55 +++++++++++++++++++++++ role_scripts/12/primary/start.sh | 55 +++++++++++++++++++++++ role_scripts/12/standby/run.sh | 55 +++++++++++++++++++++++ role_scripts/13/primary/start.sh | 55 +++++++++++++++++++++++ role_scripts/13/standby/remote-replica.sh | 55 +++++++++++++++++++++++ role_scripts/13/standby/run.sh | 55 +++++++++++++++++++++++ role_scripts/14/primary/start.sh | 55 +++++++++++++++++++++++ role_scripts/14/standby/remote-replica.sh | 55 +++++++++++++++++++++++ role_scripts/14/standby/run.sh | 55 +++++++++++++++++++++++ role_scripts/15/primary/start.sh | 55 +++++++++++++++++++++++ role_scripts/15/standby/remote-replica.sh | 55 +++++++++++++++++++++++ role_scripts/15/standby/run.sh | 55 +++++++++++++++++++++++ role_scripts/16/primary/start.sh | 35 +++++++++++++++ role_scripts/16/standby/remote-replica.sh | 35 +++++++++++++++ role_scripts/16/standby/run.sh | 35 +++++++++++++++ role_scripts/17/primary/start.sh | 35 +++++++++++++++ role_scripts/17/standby/remote-replica.sh | 35 +++++++++++++++ role_scripts/17/standby/run.sh | 35 +++++++++++++++ role_scripts/18/primary/start.sh | 35 +++++++++++++++ role_scripts/18/standby/remote-replica.sh | 35 +++++++++++++++ role_scripts/18/standby/run.sh | 35 +++++++++++++++ role_scripts/9/primary/start.sh | 33 ++++++++++++++ role_scripts/9/standby/run.sh | 33 ++++++++++++++ 26 files changed, 1162 insertions(+) diff --git a/role_scripts/10/primary/start.sh b/role_scripts/10/primary/start.sh index 82b95fb..a98323b 100755 --- a/role_scripts/10/primary/start.sh +++ b/role_scripts/10/primary/start.sh @@ -253,6 +253,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -267,6 +278,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -283,6 +305,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/10/standby/run.sh b/role_scripts/10/standby/run.sh index e7ca899..0320ae1 100755 --- a/role_scripts/10/standby/run.sh +++ b/role_scripts/10/standby/run.sh @@ -234,6 +234,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -248,6 +259,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -264,6 +286,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/11/primary/start.sh b/role_scripts/11/primary/start.sh index c57f807..f83706d 100755 --- a/role_scripts/11/primary/start.sh +++ b/role_scripts/11/primary/start.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -277,6 +288,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -291,6 +313,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -308,6 +341,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -322,6 +366,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/11/standby/run.sh b/role_scripts/11/standby/run.sh index ffd1391..0fb80c2 100755 --- a/role_scripts/11/standby/run.sh +++ b/role_scripts/11/standby/run.sh @@ -242,6 +242,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -256,6 +267,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -270,6 +292,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -287,6 +320,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -301,6 +345,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/12/primary/start.sh b/role_scripts/12/primary/start.sh index 2c40315..085572b 100755 --- a/role_scripts/12/primary/start.sh +++ b/role_scripts/12/primary/start.sh @@ -283,6 +283,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -297,6 +308,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -311,6 +333,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -328,6 +361,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -342,6 +386,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/12/standby/run.sh b/role_scripts/12/standby/run.sh index 4b3594e..85cc2cb 100755 --- a/role_scripts/12/standby/run.sh +++ b/role_scripts/12/standby/run.sh @@ -257,6 +257,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -271,6 +282,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -285,6 +307,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -302,6 +335,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -316,6 +360,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/primary/start.sh b/role_scripts/13/primary/start.sh index cafc761..3cadcce 100755 --- a/role_scripts/13/primary/start.sh +++ b/role_scripts/13/primary/start.sh @@ -304,6 +304,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -320,6 +331,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -336,6 +358,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -355,6 +388,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -371,6 +415,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/standby/remote-replica.sh b/role_scripts/13/standby/remote-replica.sh index 0119920..93c522e 100755 --- a/role_scripts/13/standby/remote-replica.sh +++ b/role_scripts/13/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/13/standby/run.sh b/role_scripts/13/standby/run.sh index c6cc7b9..7eee1d4 100755 --- a/role_scripts/13/standby/run.sh +++ b/role_scripts/13/standby/run.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -279,6 +290,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -295,6 +317,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -314,6 +347,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -330,6 +374,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/primary/start.sh b/role_scripts/14/primary/start.sh index 7ebe72e..6015005 100755 --- a/role_scripts/14/primary/start.sh +++ b/role_scripts/14/primary/start.sh @@ -308,6 +308,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -324,6 +335,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -340,6 +362,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -359,6 +392,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -375,6 +419,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/standby/remote-replica.sh b/role_scripts/14/standby/remote-replica.sh index ce4385c..8841aec 100755 --- a/role_scripts/14/standby/remote-replica.sh +++ b/role_scripts/14/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/14/standby/run.sh b/role_scripts/14/standby/run.sh index 25a5fbe..7db01e1 100755 --- a/role_scripts/14/standby/run.sh +++ b/role_scripts/14/standby/run.sh @@ -263,6 +263,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -279,6 +290,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -295,6 +317,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -314,6 +347,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -330,6 +374,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/primary/start.sh b/role_scripts/15/primary/start.sh index f128bd2..8896043 100755 --- a/role_scripts/15/primary/start.sh +++ b/role_scripts/15/primary/start.sh @@ -311,6 +311,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -327,6 +338,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -343,6 +365,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -362,6 +395,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -378,6 +422,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/standby/remote-replica.sh b/role_scripts/15/standby/remote-replica.sh index ce4385c..8841aec 100755 --- a/role_scripts/15/standby/remote-replica.sh +++ b/role_scripts/15/standby/remote-replica.sh @@ -174,6 +174,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -188,6 +199,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -202,6 +224,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -219,6 +252,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -233,6 +277,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/15/standby/run.sh b/role_scripts/15/standby/run.sh index b0df61b..57c21cc 100755 --- a/role_scripts/15/standby/run.sh +++ b/role_scripts/15/standby/run.sh @@ -262,6 +262,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -278,6 +289,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -294,6 +316,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -313,6 +346,17 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -329,6 +373,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/primary/start.sh b/role_scripts/16/primary/start.sh index 21980b6..9ecc8d9 100755 --- a/role_scripts/16/primary/start.sh +++ b/role_scripts/16/primary/start.sh @@ -310,6 +310,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -326,6 +333,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -342,6 +356,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -361,6 +382,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -377,6 +405,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/standby/remote-replica.sh b/role_scripts/16/standby/remote-replica.sh index 2d55270..4ee0698 100755 --- a/role_scripts/16/standby/remote-replica.sh +++ b/role_scripts/16/standby/remote-replica.sh @@ -172,6 +172,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -186,6 +193,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -200,6 +214,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -217,6 +238,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -231,6 +259,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/16/standby/run.sh b/role_scripts/16/standby/run.sh index afde4c0..63abf86 100755 --- a/role_scripts/16/standby/run.sh +++ b/role_scripts/16/standby/run.sh @@ -261,6 +261,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -277,6 +284,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -293,6 +307,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -312,6 +333,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -328,6 +356,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/primary/start.sh b/role_scripts/17/primary/start.sh index 81bd2c6..783406a 100755 --- a/role_scripts/17/primary/start.sh +++ b/role_scripts/17/primary/start.sh @@ -320,6 +320,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -336,6 +343,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -352,6 +366,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -371,6 +392,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -387,6 +415,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/standby/remote-replica.sh b/role_scripts/17/standby/remote-replica.sh index 8346c26..514fc6b 100755 --- a/role_scripts/17/standby/remote-replica.sh +++ b/role_scripts/17/standby/remote-replica.sh @@ -177,6 +177,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -191,6 +198,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -205,6 +219,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -222,6 +243,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -236,6 +264,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/17/standby/run.sh b/role_scripts/17/standby/run.sh index 76e0150..8e518e4 100755 --- a/role_scripts/17/standby/run.sh +++ b/role_scripts/17/standby/run.sh @@ -266,6 +266,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -282,6 +289,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -298,6 +312,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -317,6 +338,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -333,6 +361,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/primary/start.sh b/role_scripts/18/primary/start.sh index 87b0c07..ab734d6 100755 --- a/role_scripts/18/primary/start.sh +++ b/role_scripts/18/primary/start.sh @@ -313,6 +313,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -329,6 +336,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -345,6 +359,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -364,6 +385,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -380,6 +408,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/standby/remote-replica.sh b/role_scripts/18/standby/remote-replica.sh index 8346c26..514fc6b 100755 --- a/role_scripts/18/standby/remote-replica.sh +++ b/role_scripts/18/standby/remote-replica.sh @@ -177,6 +177,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -191,6 +198,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -205,6 +219,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -222,6 +243,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -236,6 +264,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/18/standby/run.sh b/role_scripts/18/standby/run.sh index 76e0150..8e518e4 100755 --- a/role_scripts/18/standby/run.sh +++ b/role_scripts/18/standby/run.sh @@ -266,6 +266,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=verify-full'; } >>/tmp/pg_hba.conf @@ -282,6 +289,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -298,6 +312,13 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -317,6 +338,13 @@ else { echo 'host replication all 127.0.0.1/32 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 scram-sha-256'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 scram-sha-256'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 scram-sha-256'; } >>/tmp/pg_hba.conf @@ -333,6 +361,13 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # include_if_exists (PostgreSQL 16+): secret updates apply on config reload. + { echo 'include_if_exists "/etc/config/user_hba.conf"'; } >>/tmp/pg_hba.conf + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/9/primary/start.sh b/role_scripts/9/primary/start.sh index 25a4d9c..1d98613 100755 --- a/role_scripts/9/primary/start.sh +++ b/role_scripts/9/primary/start.sh @@ -248,6 +248,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -262,6 +273,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -278,6 +300,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf diff --git a/role_scripts/9/standby/run.sh b/role_scripts/9/standby/run.sh index bb43de4..fca2cd9 100755 --- a/role_scripts/9/standby/run.sh +++ b/role_scripts/9/standby/run.sh @@ -231,6 +231,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 cert clientcert=1'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 cert clientcert=1'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 cert clientcert=1'; } >>/tmp/pg_hba.conf @@ -245,6 +256,17 @@ if [[ "${SSL:-0}" == "ON" ]]; then { echo 'hostssl replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'hostssl all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'hostssl all all ::/0 md5'; } >>/tmp/pg_hba.conf @@ -261,6 +283,17 @@ else { echo 'host replication all 127.0.0.1/32 md5'; } >>/tmp/pg_hba.conf { echo 'host replication all ::1/128 md5'; } >>/tmp/pg_hba.conf + # KubeDB: user-supplied pg_hba rules (configSecret key: user_hba.conf). + # They go before the catch-all rules below (pg_hba.conf is first-match-wins) + # and after the local/loopback rules above, so custom rules can override the + # defaults but cannot lock out the operator's own scripts. + # PostgreSQL <= 15 cannot include files from pg_hba.conf, so the content is + # copied in at generation time; secret changes take effect on pod restart. + if [[ -s /etc/config/user_hba.conf ]]; then + cat /etc/config/user_hba.conf >>/tmp/pg_hba.conf + echo '' >>/tmp/pg_hba.conf + fi + { echo 'host all all 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host replication postgres 0.0.0.0/0 md5'; } >>/tmp/pg_hba.conf { echo 'host all all ::/0 md5'; } >>/tmp/pg_hba.conf