feat(postgres): ssl for postgres #2473

bearrito · 2024-04-08T18:45:57Z

What does this PR do?

Enables SSL for postgres

The main thing to recognize when reviewing this is that the secret material must be owned by the postgres user.
The docker file copy api doesn't allowfor setting a user when copying. The only way I could think was to take wrap the entrypoint script with one that does what we want.

Why is it important?

User ran into issue trying to use SSL. It's not obviously supported (able) due to file permissions.

Related issues

Link related issues below. Insert the issue link or reference after the word "Closes" if merging this should automatically close it.

Closes [Bug]: File permissions with custom PostgreSQL image #2404

How to test this PR

Unit tests will work when complete.

netlify · 2024-04-08T18:46:13Z

✅ Deploy Preview for testcontainers-go ready!

Name	Link
🔨 Latest commit	`e980a90`
🔍 Latest deploy log	https://app.netlify.com/sites/testcontainers-go/deploys/676b533dd45e9900083bdc39
😎 Deploy Preview	https://deploy-preview-2473--testcontainers-go.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

modules/postgres/testdata/docker-entrypoint-ssl.bash

mdelapenya

We are in the right track with this one, although I left some comments that need to be addressed.

Besides that, we need to include the new option in the docs. Please check the docs/modules/postgres.md file for that. Remember adding this right after the option title:

- Not available until the next release of testcontainers-go <a href="https://github.com/testcontainers/testcontainers-go"><span class="tc-version">:material-tag: main</span></a>

Thanks!

modules/postgres/postgres_test.go

modules/postgres/postgres.go

modules/postgres/options.go

modules/postgres/testdata/docker-entrypoint-ssl.bash

mdelapenya · 2024-04-10T14:39:06Z

@bearrito could you please take a look at #2478? I'm adding helper code to deal with TLS certificates in order to simplify the story for the client code. Wdyt?

bearrito · 2024-04-10T15:57:37Z

@mdelapenya That makes a lot of sense. Much cleaner.

Do you want me to wait until that's done then base this on top of that?

mdelapenya · 2024-04-11T16:00:02Z

@bearrito I went ahead and extracted the TLS cert generation to a separate go package, which makes more sense: https://github.com/mdelapenya/tlscert

Please take a look and use it as you need here!

bearrito · 2024-04-11T19:15:12Z

@mdelapenya Updated to use your package.

mdelapenya

Just one final concern regarding the entrypoint: do you think we need to pass it? Or is it something we can internally handle in the module, being transparent to the end users?

modules/postgres/go.mod

modules/postgres/testdata/docker-entrypoint-ssl.bash

bearrito · 2024-04-12T13:21:13Z

@mdelapenya Update so that the entrypoint is coupled with the ssl settings. What about doing something similar for the conf file?

modules/postgres/postgres.go

modules/postgres/postgres_test.go

modules/postgres/postgres.go

bearrito · 2024-04-24T13:14:36Z

@mdelapenya added docs.

bearrito · 2024-05-23T13:19:19Z

@mdelapenya Anything else on this? I'm going on holiday and am closing out my open pr's

mdelapenya

Sorry for the late response :(

I think we are close to make it into the project, but let's clarify the custom entry point, as I'm not sure if I understand its use case properly

Thanks!

mdelapenya · 2024-07-17T12:00:45Z

modules/postgres/postgres_test.go

+		os.RemoveAll(tmpDir)
+	})
+
+	caCert := tlscert.SelfSignedFromRequest(tlscert.Request{


Have you considered using tlscert.SelfSignedCA here instead? See https://github.com/mdelapenya/tlscert/blob/a038576e80ef259d2a60317ab51e37cdda8da3c8/tlscert.go#L135

modules/postgres/resources/customEntrypoint.sh

mdelapenya · 2024-12-05T11:57:12Z

@stevenh with the latest merges, I think we can prioritise this one using the new approach for TLS, wdyt?

bearrito · 2024-12-20T20:53:27Z

@stevenh with the latest merges, I think we can prioritise this one using the new approach for TLS, wdyt?

I dropped off from this for a while. Two questions

Is the PR still valid?
Are there merged changes that invalidate any of the approaches?

stevenh

I don't believe we can use the new SSL wait as this container doesn't have the option to generate its own certs?

Assuming that's the case I've done review pass, so we can get this moving.

stevenh · 2024-12-23T11:33:54Z

modules/postgres/postgres.go

+		expectedFiles := []string{sslSettings.CACertFile, sslSettings.CertFile, sslSettings.KeyFile}
+		for _, expectedFile := range expectedFiles {
+			_, err := os.Stat(expectedFile)
+			if err != nil {
+				return err
+			}
+		}


suggestion: I don't believe this is needed as it would caught by the copy handler, see full suggestion below.

modules/postgres/postgres_test.go

modules/postgres/options.go

modules/postgres/postgres.go

Co-authored-by: Steven Hartland <[email protected]>

stevenh

Thanks for the changes, there's some outstanding bits needed to complete the switch to parameters, think I've caught them all in this pass.

modules/postgres/options.go

modules/postgres/postgres_test.go

modules/postgres/resources/customEntrypoint.sh

modules/postgres/options.go

bearrito · 2024-12-25T00:35:24Z

Addressed latest.

stevenh

Thanks for the fast turnaround on the changes, looks good to me, happy holidays!

bearrito · 2024-12-25T16:39:12Z

@mdelapenya Is this good to go from your end?

SSL for postgres

daa8cf2

bearrito requested a review from a team as a code owner April 8, 2024 18:45

bstrausser added 2 commits April 8, 2024 17:08

Add entrypoint wrapper

53e2135

Add in init so we can test ssl+init path

bd3360d

bearrito changed the title ~~[DRAFT] feat:SSL for postgres~~ feat:SSL for postgres Apr 8, 2024

bearrito mentioned this pull request Apr 8, 2024

[Bug]: File permissions with custom PostgreSQL image #2404

Open

bearrito commented Apr 8, 2024

View reviewed changes

modules/postgres/testdata/docker-entrypoint-ssl.bash Outdated Show resolved Hide resolved

bstrausser added 2 commits April 8, 2024 17:17

Remove unused fields from options

c3fd69b

Remove unused consts

445a575

mdelapenya requested changes Apr 9, 2024

View reviewed changes

modules/postgres/postgres_test.go Outdated Show resolved Hide resolved

modules/postgres/postgres.go Outdated Show resolved Hide resolved

modules/postgres/options.go Outdated Show resolved Hide resolved

bearrito commented Apr 9, 2024

View reviewed changes

modules/postgres/testdata/docker-entrypoint-ssl.bash Outdated Show resolved Hide resolved

Separate entrypoint from ssl

8814e8c

Use external cert generation

2aecc1b

bearrito mentioned this pull request Apr 11, 2024

chore: create TLS certs in a consistent manner #2478

Merged

mdelapenya reviewed Apr 12, 2024

View reviewed changes

modules/postgres/go.mod Outdated Show resolved Hide resolved

modules/postgres/testdata/docker-entrypoint-ssl.bash Outdated Show resolved Hide resolved

bstrausser added 2 commits April 12, 2024 09:14

Make entrypoint not-optional

eac665d

Add docstring

302472c

bearrito commented Apr 12, 2024

View reviewed changes

modules/postgres/postgres.go Outdated Show resolved Hide resolved

bearrito commented Apr 12, 2024

View reviewed changes

modules/postgres/postgres_test.go Outdated Show resolved Hide resolved

bearrito commented Apr 12, 2024

View reviewed changes

modules/postgres/postgres_test.go Outdated Show resolved Hide resolved

bearrito commented Apr 12, 2024

View reviewed changes

modules/postgres/postgres.go Outdated Show resolved Hide resolved

bstrausser added 2 commits April 24, 2024 08:56

Spaces to tab in entrypoint

3099790

Add postgres ssl docs

e067d0f

bstrausser and others added 5 commits April 26, 2024 11:31

Update doc for required conf

e28361a

Merge branch 'main' into feature/postgres-ssl

8502649

Error checking in the customizer

5d8598f

Few formatting fix

dffe996

Use non-nil error when err is nil

53d9a1a

mdelapenya reviewed Jul 17, 2024

View reviewed changes

stevenh requested changes Dec 23, 2024

View reviewed changes

bearrito and others added 9 commits December 23, 2024 16:27

Update modules/postgres/postgres_test.go

146f47d

Co-authored-by: Steven Hartland <[email protected]>

Update modules/postgres/postgres_test.go

94bd7f4

Co-authored-by: Steven Hartland <[email protected]>

Update modules/postgres/postgres.go

dfa322e

Co-authored-by: Steven Hartland <[email protected]>

Update modules/postgres/postgres.go

18ab8b7

Co-authored-by: Steven Hartland <[email protected]>

Update modules/postgres/postgres_test.go

ab0e3ff

Co-authored-by: Steven Hartland <[email protected]>

Addresses review modulo cleanup

9e15ac5

Remove unused type

c1cda1e

Merge main into feature/postgres-ssl

3dfb0cb

Use ContainerCleanup

ff6ce3e

stevenh requested changes Dec 24, 2024

View reviewed changes

Lint pass

6adf44c

bearrito changed the title ~~feat:SSL for postgres~~ feat(postgres):SSL for postgres Dec 24, 2024

Add t.Helper and Linting

6fb5455

bearrito changed the title ~~feat(postgres):SSL for postgres~~ feat(postgres): SSL for postgres Dec 24, 2024

bearrito changed the title ~~feat(postgres): SSL for postgres~~ feat(postgres): ssl for postgres Dec 24, 2024

bstrausser added 2 commits December 24, 2024 19:32

Remove SSLSetting struct, use raw paths

81a8d18

Use single command for chown key material

e980a90

stevenh approved these changes Dec 25, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(postgres): ssl for postgres #2473

feat(postgres): ssl for postgres #2473

bearrito commented Apr 8, 2024 •

edited

Loading

netlify bot commented Apr 8, 2024 •

edited

Loading

mdelapenya left a comment •

edited

Loading

mdelapenya commented Apr 10, 2024

bearrito commented Apr 10, 2024 •

edited

Loading

mdelapenya commented Apr 11, 2024

bearrito commented Apr 11, 2024

mdelapenya left a comment

bearrito commented Apr 12, 2024

bearrito commented Apr 24, 2024

bearrito commented May 23, 2024

mdelapenya left a comment

mdelapenya Jul 17, 2024

mdelapenya commented Dec 5, 2024

bearrito commented Dec 20, 2024

stevenh left a comment •

edited

Loading

stevenh Dec 23, 2024 •

edited

Loading

stevenh left a comment

bearrito commented Dec 25, 2024

stevenh left a comment

bearrito commented Dec 25, 2024

feat(postgres): ssl for postgres #2473

Are you sure you want to change the base?

feat(postgres): ssl for postgres #2473

Conversation

bearrito commented Apr 8, 2024 • edited Loading

What does this PR do?

Why is it important?

Related issues

How to test this PR

netlify bot commented Apr 8, 2024 • edited Loading

✅ Deploy Preview for testcontainers-go ready!

mdelapenya left a comment • edited Loading

Choose a reason for hiding this comment

mdelapenya commented Apr 10, 2024

bearrito commented Apr 10, 2024 • edited Loading

mdelapenya commented Apr 11, 2024

bearrito commented Apr 11, 2024

mdelapenya left a comment

Choose a reason for hiding this comment

bearrito commented Apr 12, 2024

bearrito commented Apr 24, 2024

bearrito commented May 23, 2024

mdelapenya left a comment

Choose a reason for hiding this comment

mdelapenya Jul 17, 2024

Choose a reason for hiding this comment

mdelapenya commented Dec 5, 2024

bearrito commented Dec 20, 2024

stevenh left a comment • edited Loading

Choose a reason for hiding this comment

stevenh Dec 23, 2024 • edited Loading

Choose a reason for hiding this comment

stevenh left a comment

Choose a reason for hiding this comment

bearrito commented Dec 25, 2024

stevenh left a comment

Choose a reason for hiding this comment

bearrito commented Dec 25, 2024

bearrito commented Apr 8, 2024 •

edited

Loading

netlify bot commented Apr 8, 2024 •

edited

Loading

mdelapenya left a comment •

edited

Loading

bearrito commented Apr 10, 2024 •

edited

Loading

stevenh left a comment •

edited

Loading

stevenh Dec 23, 2024 •

edited

Loading