* fix(spire-server): support postgres TLS client-certificate (passwordless) auth
The postgres datastore always injected a password into the connection
string, always created the -dbpw Secret, and always set the DBPW env var,
with no way to use TLS client-certificate (or IAM) authentication. This
forced a dummy password (e.g. "unused") when authenticating with certs.
- Map dataStore.sql.rootCAPath / clientCertPath / clientKeyPath to the
postgres connection-string options sslrootcert / sslcert / sslkey
(previously these were mysql-only and rejected for postgres). MySQL keeps
using the root_ca_path / client_cert_path / client_key_path plugin fields,
now correctly gated to mysql/aws_mysql only.
- For postgres/aws_postgres, when dataStore.sql.password is empty, omit
"password=${DBPW}" from the connection string and skip creating the -dbpw
Secret and the DBPW/RODBPW env vars (mirrors the existing gcp_mysql_sa_iam
passwordless behavior).
- Add a guard: for postgres, dataStore.sql.password and clientCertPath are
mutually exclusive.
- Fix a stray tab in the mysql client_key_path config field.
- Update value docs and regenerate the README.
Existing configurations with a password set are unaffected.
Signed-off-by: Michael Munch <[email protected]>
* 🐛 fix(spire-server): keep postgres password when external secret is used
The postgres passwordless path keyed only on an empty password, so
enabling dataStore.sql.externalSecret (or readOnly.externalSecret) with
an empty password dropped the password token from the connection string
and skipped the DBPW/RODBPW env vars, breaking external-secret auth.
- Add shared passwordless predicates that also require external secrets
to be disabled, evaluated independently for read-write and read-only.
- Use the predicates in datastore-config, secret.yaml, and
server-resource.yaml so the gating cannot drift.
- Add unit tests for postgres with read-write and read-only external
secrets plus the cert-auth passwordless case.
Signed-off-by: Michael Munch <[email protected]>
* 🔁 ci: re-trigger checks
Re-run CI; the previous spiffe-step-ssh integration job failed on an
unrelated flaky SSH host-key verification on k8s v1.35.1 (passed on
v1.33.7 and v1.34.3).
Signed-off-by: Michael Munch <[email protected]>
---------
Signed-off-by: Michael Munch <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
