v0.7.0

Upgrade notes

PR #71 changes how the operator sets and tracks Role passwords. Read these notes before you upgrade from v0.6.0 or earlier.

Upgrade steps

1. Apply the new Role CRD. helm upgrade does not update CRDs, and the Role CRD has two new fields. The other CRDs did not change.

   kubectl apply --server-side --force-conflicts -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/roles.postgresql.aboutbits.it-v1.yml

2. Set passwordEncryption: server on each Role that must keep the old behavior. See "Password encryption" below.
3. Upgrade the Helm chart.

   helm upgrade postgresql-operator https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/postgresql-operator-0.7.0.tgz

If you skip step 1, Kubernetes removes the new fields. The operator then sets the password of each Role again on every reconcile.

Password encryption

The operator now computes the SCRAM-SHA-256 verifier and sends only the verifier to PostgreSQL. The cleartext password no longer reaches the server or its statement log.
Before, the operator sent the cleartext password, and the server hashed it according to password_encryption.

After the upgrade, each existing Role with a passwordSecretRef gets one password update. The password does not change, but PostgreSQL then stores it as SCRAM-SHA-256.
Set passwordEncryption: server on the Role in these cases:

• Clients of the role support only MD5 authentication.
• The server has a password policy, such as the credcheck extension or the Cloud SQL password policy. These policies do not check a pre-hashed password, and credcheck rejects it by default.

The Secret is the source of truth

The operator no longer reads the password hash from pg_authid. It keeps a keyed fingerprint of the applied password in status.passwordFingerprint.
The operator does not detect or revert a password change that someone makes directly in PostgreSQL. Change the password in the Secret.

New Secret and RBAC rule

The operator creates the Secret postgresql-operator-password-fingerprint-key in its own namespace. This Secret holds the fingerprint key. Treat it as a credential.
The Helm chart adds a Role and a RoleBinding that grant create on Secrets in the operator namespace only. If you deploy the operator without the Helm chart, add this rule yourself.

See Password handling and Admin privileges for details.

Installation

Helm Chart

helm install postgresql-operator https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/postgresql-operator-0.7.0.tgz

With the Helm chart, the Custom Resource Definitions (CRDs) are installed automatically.
However, if you deploy the operator directly from the OCI image, the CRDs are not automatically applied and must be installed separately.

Manual CRD Installation

kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/clusterconnections.postgresql.aboutbits.it-v1.yml
kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/databases.postgresql.aboutbits.it-v1.yml
kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/schemas.postgresql.aboutbits.it-v1.yml
kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/roles.postgresql.aboutbits.it-v1.yml
kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/grants.postgresql.aboutbits.it-v1.yml
kubectl apply -f https://github.com/aboutbits/postgresql-operator/releases/download/v0.7.0/defaultprivileges.postgresql.aboutbits.it-v1.yml

What's Changed

• Reconcile Role resources with a non-superuser admin such as the master user of managed PostgreSQL cloud services by @ThoSap in #71 (see Upgrade notes)
• Use constructor injection for @ConfigProperty and qualified fields by @ThoSap in #74
• AB-580 Update Ubuntu runners and GitHub Actions by @ThoSap in #75

Full Changelog: v0.6.0...v0.7.0