[bitnami/postgresql] checks improperly quoted

[sdahlbac]

Name and Version

bitnami/postgresql 11.1.19

What steps will reproduce the bug?

1. I am deploying the helm chart using terraform, but that should not matter
2. with tls enabled and healtchecks enabled postgres does not start

Are you using any custom parameters or values?

tls.enabled: yes
tls.certificatesSecret: postgresql-tls-secret
tls.certFilename: cert.crt
tls.certKeyFilename: cert.key
tls.certCAFilename: ca.crt
primary.livenessProbe.enabled: true
primary.readinessProbe.enabled: true

primary.pgHbaConfiguration includes
hostssl all postgresql 127.0.0.1/32 cert

What is the expected behavior?

Postgres should start properly

What do you see instead?

The command for the probes are rendered as

exec pg_isready -U "postgres" -d "sslcert=/opt/bitnami/postgresql/certs/cert.crt sslkey=/opt/bitnami/postgresql/certs/cert.key" -h 127.0.0.1 -p 5432

If I run that manually:

I have no name!@postgresql-0:/$ pg_isready -U "postgres" -d "sslcert=/opt/bitnami/postgresql/certs/cert.crt sslkey=/opt/bitnami/postgresql/certs/cert.key" -h 127.0.0.1 -p 5432
127.0.0.1:5432 - no response

If I instead do

pg_isready -U "postgres" -d "sslcert=/opt/bitnami/postgresql/certs/cert.crt" -d"sslkey=/opt/bitnami/postgresql/certs/cert.key" -h 127.0.0.1 -p 5432
127.0.0.1:5432 - accepting connections

i.e. separate -d options

Additional information

I suspect if I'd use custom checks I would be able to make it work

[javsalgar]

Hi,

Does the issue happen with the auto-generated tls certificates?

[sdahlbac]

I haven't tried, since I cannot use them

[sdahlbac]

Not sure if this is related, but

 pg_isready --help
pg_isready issues a connection check to a PostgreSQL database.

Usage:
  pg_isready [OPTION]...

Options:
  -d, --dbname=DBNAME      database name
  -q, --quiet              run quietly
  -V, --version            output version information, then exit
  -?, --help               show this help, then exit

Connection options:
  -h, --host=HOSTNAME      database server host or socket directory
  -p, --port=PORT          database server port
  -t, --timeout=SECS       seconds to wait when attempting connection, 0 disables (default: 3)
  -U, --username=USERNAME  user name to connect as

I'm a bit surprised that this could even work

[javsalgar]

Hi,

It seems that the -d allows setting postgresql connection strings where you can set the tls settings. If you don't specify the database name it will assume it is the postgres database. I tried with this command and found no issues in the probes

helm install psql bitnami/postgresql --set tls.enabled=true --set tls.autoGenerated=true

NAME                READY   STATUS    RESTARTS   AGE
psql-postgresql-0   1/1     Running   0          42s

    Liveness:   exec [/bin/sh -c exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432] delay=30s timeout=5s period=10s #success=1 #failure=6
    Readiness:  exec [/bin/sh -c -e exec pg_isready -U "postgres" -d "sslcert=/opt/bitnami/postgresql/certs/tls.crt sslkey=/opt/bitnami/postgresql/certs/tls.key" -h 127.0.0.1 -p 5432

Could it be that the certs you are using are not compatible with PostgreSQL?

[sdahlbac]

This is not an issue as such, since it turns out that my cert was missing extendedKeyUsage = clientAuth

However, I have still not figured out how to enable hostssl all all all scram-sha-256

Since if I provide

  set {
    name  = "primary.pgHbaConfiguration"
    value = <<EOF
# TYPE  DATABASE        USER            ADDRESS                 METHOD
local    all             all                                     scram-sha-256
host     all             all        ::1/128                      scram-sha-256
hostssl  all             postgresql 127.0.0.1/32                 cert
hostssl  all             all        all                          scram-sha-256
    EOF
  }

I end up with

Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.70 Welcome to the Bitnami postgresql container
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.70 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.70 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.70
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.71 DEBUG ==> Configuring libnss_wrapper...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.72 INFO ==> ** Starting PostgreSQL setup **
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.75 INFO ==> Validating settings in POSTGRESQL_* env vars..
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.76 INFO ==> Loading custom pre-init scripts...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.77 INFO ==> Initializing PostgreSQL database...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.77 DEBUG ==> Copying files from /bitnami/postgresql/conf to /opt/bitnami/postgresql/conf
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.78 INFO ==> Custom configuration /opt/bitnami/postgresql/conf/pg_hba.conf detected
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.78 DEBUG ==> Ensuring expected directories/files exist...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.81 INFO ==> Deploying PostgreSQL with persisted data...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.82 INFO ==> Configuring replication parameters
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.86 INFO ==> Configuring fsync
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.87 INFO ==> Configuring TLS
Wed, Apr 13 2022 2:12:23 pm | chmod: changing permissions of '/opt/bitnami/postgresql/certs/tls.key': Read-only file system
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.87 WARN ==> Could not set compulsory permissions (600) on file /opt/bitnami/postgresql/certs/tls.key
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.93 INFO ==> Loading custom scripts...
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.93 INFO ==> Enabling remote connections
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.95 INFO ==> ** PostgreSQL setup finished! **
Wed, Apr 13 2022 2:12:23 pm |  
Wed, Apr 13 2022 2:12:23 pm | postgresql 11:12:23.98 INFO ==> ** Starting PostgreSQL **
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.000 GMT [1] LOG: pgaudit extension initialized
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.019 GMT [1] LOG: starting PostgreSQL 14.2 on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.020 GMT [1] LOG: listening on IPv4 address "0.0.0.0", port 5432
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.020 GMT [1] LOG: listening on IPv6 address "::", port 5432
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.023 GMT [1] LOG: listening on Unix socket "/tmp/.s.PGSQL.5432"
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.029 GMT [103] LOG: database system was shut down at 2022-04-13 11:12:23 GMT
Wed, Apr 13 2022 2:12:24 pm | 2022-04-13 11:12:24.036 GMT [1] LOG: database system is ready to accept connections
Wed, Apr 13 2022 2:12:30 pm | 2022-04-13 11:12:30.573 GMT [116] FATAL: password authentication failed for user "postgres"
Wed, Apr 13 2022 2:12:30 pm | 2022-04-13 11:12:30.573 GMT [116] DETAIL: User "postgres" has no password assigned.

i.e. the password is not set for user postgres