Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump gocloud dependency to fix aws CA validation #340

Merged
merged 1 commit into from
Sep 9, 2023

Conversation

toadjaune
Copy link
Contributor

Bump gocloud library dependency to include fixes from google/go-cloud#3307

I have tested it locally and can confirm that it fixes connexion to an AWS instance using rds-ca-ecc384-g1 CA.

The go tests pass, I have however not run the acceptance tests. This sounds like the kind of change for which we would want to run them before merging.

@pedrocarrico
Copy link

Hi @toadjaune , I'm having an error too after updating the CA authority in one of my RDS databases:

Error: error detecting capabilities: error PostgreSQL version: x509: certificate signed by unknown authority

I've started to have that error after migrating to the rds-ca-rsa2048-g1 CA authority.
Reverting back to the rds-ca-2019 CA authority I no longer see these errors.

I've ran the script for importing certificates into my trust store and it successfully added it but seems like something is not working alongside this provider.

Could this be related to what you're reporting and the changes you're proposing in this pull request?

Thanks,

@pedrocarrico
Copy link

Also, I've tried to run with sslmode = "disabled" and I still got the same error.

What seems to work is to change from scheme = "awspostgres" to scheme = "postgres" which seems to indicate that the issue might indeed be in the usage of the gocloud package.

@toadjaune
Copy link
Contributor Author

Hi @pedrocarrico !

Indeed, this is exactly what this PR fixes :)

To sum up :

  • when using awspostgres scheme, the gocloud library internally manages TLS configuration
    • that's why it doesn't matter whether the CA is in your OS trust store
  • in its current version, it uses an outdated certificate bundle, leading to errors when connecting on RDS instances using newer CA
  • it does not seem possible to configure sslmode or sslrootcert to override this behavior at a configuration level
  • the normal postgres scheme shoud indeed work, as it is meant to interact with arbitrary pg servers, it is therefore configurable, and I assume that it can look CAs up in the OS trust store

If you're authenticating with login/password, switching to the postgres scheme should be your easiest temporary workaround.
It's however not an option if you rely on IAM database authentication (which is my case)

@toadjaune
Copy link
Contributor Author

Also, I'm wondering : did you upgrade your CA because AWS sent you a warning email about future CA expiration ?

It seems they have started doing so, which means more and more people will start encountering this issue.
Which in turn means we should probably not wait too long before merging this.

@pedrocarrico
Copy link

@toadjaune Yes I've received that same warning email.

Thanks for the clarification, it makes much more sense now.
Indeed I don't (currently) rely on IAM authentication, but funny enough I was actually starting to consider it as I bumped into this issue.

Thank you so much once again

Copy link
Owner

@cyrilgdn cyrilgdn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you 👍

@cyrilgdn cyrilgdn merged commit 7a3fb5e into cyrilgdn:master Sep 9, 2023
@cyrilgdn
Copy link
Owner

Released in v1.21.0

@toadjaune toadjaune deleted the bump-gocloud branch September 11, 2023 07:38
dduportal referenced this pull request in jenkins-infra/azure Sep 23, 2023
<Actions>
<action
id="16c2f665ec8f38b263f8d1f01847791b753aaf4c15655cd80097752f2ecae989">
        <h3>Bump Terraform `postgresql` provider version</h3>
<details
id="1d9343c012f5434ac9fe8a98135bae3667b399259be16d9b14302ea3bd424a24">
            <summary>Update Terraform lock file</summary>
<p>&#34;cyrilgdn/postgresql&#34; updated from &#34;1.21.0&#34; to
&#34;1.21.0&#34; in file &#34;.terraform.lock.hcl&#34;</p>
            <details>
                <summary>1.21.0</summary>
<pre>Changelog retrieved
from:&#xA;&#x9;https://github.com/cyrilgdn/terraform-provider-postgresql/releases/tag/v1.21.0&#xA;##
What&#39;s Changed&#xD;&#xA;* Make function security, strictness,
volatility, and parallel safety configurable by @tommyzli in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/307&#xD;&#xA;*
postgresql_publication.markdown - table ordering by @RoseateSpoonbill in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/265&#xD;&#xA;*
Bump gocloud dependency to fix aws CA validation by @toadjaune in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/340&#xD;&#xA;*
feat: Allow for inlining client cert by @vr in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/342&#xD;&#xA;*
Update postgresql_extension.html.markdown by @tspearconquest in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/337&#xD;&#xA;*
Use uint32 for OID to stop conversion errors with pguint32 by @mat285 in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/324&#xD;&#xA;*
feat: Postgresql 15 support by @cyrilgdn in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/348&#xD;&#xA;*
Added MS Azure passwordless authentication by @librucha in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/346&#xD;&#xA;*
Add &#39;Injecting credentials&#39; section to provider docs by @rdarcy1
in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/318&#xD;&#xA;*
fixed escaping for postgresql user info by @librucha in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/344&#xD;&#xA;&#xD;&#xA;##
New Contributors&#xD;&#xA;* @tommyzli made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/307&#xD;&#xA;*
@RoseateSpoonbill made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/265&#xD;&#xA;*
@toadjaune made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/340&#xD;&#xA;*
@vr made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/342&#xD;&#xA;*
@tspearconquest made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/337&#xD;&#xA;*
@mat285 made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/324&#xD;&#xA;*
@librucha made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/346&#xD;&#xA;*
@rdarcy1 made their first contribution in
https://github.com/cyrilgdn/terraform-provider-postgresql/pull/318&#xD;&#xA;&#xD;&#xA;**Full
Changelog**:
https://github.com/cyrilgdn/terraform-provider-postgresql/compare/v1.20.0...v1.21.0</pre>
            </details>
        </details>
    </action>
</Actions>

---

<table>
  <tr>
    <td width="77">
<img src="https://www.updatecli.io/images/updatecli.png" alt="Updatecli
logo" width="50" height="50">
    </td>
    <td>
      <p>
Created automatically by <a
href="https://www.updatecli.io/">Updatecli</a>
      </p>
      <details><summary>Options:</summary>
        <br />
<p>Most of Updatecli configuration is done via <a
href="https://www.updatecli.io/docs/prologue/quick-start/">its
manifest(s)</a>.</p>
        <ul>
<li>If you close this pull request, Updatecli will automatically reopen
it, the next time it runs.</li>
<li>If you close this pull request and delete the base branch, Updatecli
will automatically recreate it, erasing all previous commits made.</li>
        </ul>
        <p>
Feel free to report any issues at <a
href="https://github.com/updatecli/updatecli/issues">github.com/updatecli/updatecli</a>.<br
/>
If you find this tool useful, do not hesitate to star <a
href="https://github.com/updatecli/updatecli/stargazers">our GitHub
repository</a> as a sign of appreciation, and/or to tell us directly on
our <a
href="https://matrix.to/#/#Updatecli_community:gitter.im">chat</a>!
        </p>
      </details>
    </td>
  </tr>
</table>

Co-authored-by: Jenkins Infra Bot (updatecli) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants