Merge pull request #65 from Duologic/duologic/postgresql-sslmode

Add SSLMode for PostgreSQL

apis/postgresql/v1alpha1/provider_types.go

@@ -30,6 +30,11 @@ type ProviderConfigSpec struct {
 	// PostgreSQL instance. Same as PGDATABASE environment variable.
 	// +kubebuilder:default="postgres"
 	DefaultDatabase string `json:"defaultDatabase,omitempty"`
+	// Defines the SSL mode used to set up a connection to the provided
+	// PostgreSQL instance
+	// +kubebuilder:validation:Enum=disable;require;verify-ca;verify-full
+	// +optional
+	SSLMode string `json:"sslMode"`
 }
 
 const (

package/crds/postgresql.sql.crossplane.io_providerconfigs.yaml

@@ -70,6 +70,14 @@ spec:
                 default: postgres
                 description: Defines the database name used to set up a connection to the provided PostgreSQL instance. Same as PGDATABASE environment variable.
                 type: string
+              sslMode:
+                description: Defines the SSL mode used to set up a connection to the provided PostgreSQL instance
+                enum:
+                - disable
+                - require
+                - verify-ca
+                - verify-full
+                type: string
             required:
             - credentials
             type: object

pkg/clients/postgresql/postgresql.go

@@ -23,26 +23,31 @@ type postgresDB struct {
 	dsn      string
 	endpoint string
 	port     string
+	sslmode  string
 }
 
 // New returns a new PostgreSQL database client. The default database name is
 // an empty string. The underlying pq library will default to either using the
 // value of PGDATABASE, or if unset, the hardcoded string 'postgres'.
-func New(creds map[string][]byte, database string) xsql.DB {
+// The sslmode defines the mode used to set up the connection for the provider.
+func New(creds map[string][]byte, database, sslmode string) xsql.DB {
 	// TODO(negz): Support alternative connection secret formats?
 	endpoint := string(creds[xpv1.ResourceCredentialsSecretEndpointKey])
 	port := string(creds[xpv1.ResourceCredentialsSecretPortKey])
 	username := string(creds[xpv1.ResourceCredentialsSecretUserKey])
 	password := string(creds[xpv1.ResourceCredentialsSecretPasswordKey])
+	dsn := DSN(username, password, endpoint, port, database, sslmode)
+
 	return postgresDB{
-		dsn:      DSN(username, password, endpoint, port, database),
+		dsn:      dsn,
 		endpoint: endpoint,
 		port:     port,
+		sslmode:  sslmode,
 	}
 }
 
 // DSN returns the DSN URL
-func DSN(username, password, endpoint, port, database string) string {
+func DSN(username, password, endpoint, port, database, sslmode string) string {
 	// Use net/url UserPassword to encode the username and password
 	// This will ensure that any special characters in the username or password
 	// are percent-encoded for use in the user info portion of the DSN URL
@@ -51,7 +56,8 @@ func DSN(username, password, endpoint, port, database string) string {
 		userInfo.String() + "@" +
 		endpoint + ":" +
 		port + "/" +
-		database
+		database +
+		"?sslmode=" + sslmode
 }
 
 // ExecTx executes an array of queries, committing if all are successful and

pkg/clients/postgresql/postgresql_test.go

@@ -11,8 +11,9 @@ func TestDSNURLEscaping(t *testing.T) {
 	user := "username"
 	rawPass := "password^"
 	encPass := "password%5E"
-	dsn := DSN(user, rawPass, endpoint, port, db)
-	if dsn != "postgres://"+user+":"+encPass+"@"+endpoint+":"+port+"/"+db {
+	sslmode := "require"
+	dsn := DSN(user, rawPass, endpoint, port, db, sslmode)
+	if dsn != "postgres://"+user+":"+encPass+"@"+endpoint+":"+port+"/"+db+"?sslmode="+sslmode {
 		t.Errorf("DSN string did not match expected output with userinfo URL encoded")
 	}
 }

pkg/controller/postgresql/database/reconciler.go

@@ -86,7 +86,7 @@ func Setup(mgr ctrl.Manager, l logging.Logger) error {
 type connector struct {
 	kube  client.Client
 	usage resource.Tracker
-	newDB func(creds map[string][]byte, database string) xsql.DB
+	newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 }
 
 func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
@@ -119,7 +119,7 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 		return nil, errors.Wrap(err, errGetSecret)
 	}
 
-	return &external{db: c.newDB(s.Data, pc.Spec.DefaultDatabase)}, nil
+	return &external{db: c.newDB(s.Data, pc.Spec.DefaultDatabase, pc.Spec.SSLMode)}, nil
 }
 
 type external struct{ db xsql.DB }

pkg/controller/postgresql/database/reconciler_test.go

@@ -64,7 +64,7 @@ func TestConnect(t *testing.T) {
 	type fields struct {
 		kube  client.Client
 		usage resource.Tracker
-		newDB func(creds map[string][]byte, database string) xsql.DB
+		newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 	}
 
 	type args struct {

pkg/controller/postgresql/extension/reconciler.go

@@ -76,7 +76,7 @@ func Setup(mgr ctrl.Manager, l logging.Logger) error {
 type connector struct {
 	kube  client.Client
 	usage resource.Tracker
-	newDB func(creds map[string][]byte, database string) xsql.DB
+	newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 }
 
 func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
@@ -112,10 +112,10 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 	// We do not want to create an extension on the default DB
 	// if the user was expecting a database name to be resolved.
 	if cr.Spec.ForProvider.Database != nil {
-		return &external{db: c.newDB(s.Data, *cr.Spec.ForProvider.Database)}, nil
+		return &external{db: c.newDB(s.Data, *cr.Spec.ForProvider.Database, pc.Spec.SSLMode)}, nil
 	}
 
-	return &external{db: c.newDB(s.Data, pc.Spec.DefaultDatabase)}, nil
+	return &external{db: c.newDB(s.Data, pc.Spec.DefaultDatabase, pc.Spec.SSLMode)}, nil
 }
 
 type external struct{ db xsql.DB }

pkg/controller/postgresql/extension/reconciler_test.go

@@ -64,7 +64,7 @@ func TestConnect(t *testing.T) {
 	type fields struct {
 		kube  client.Client
 		usage resource.Tracker
-		newDB func(creds map[string][]byte, database string) xsql.DB
+		newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 	}
 
 	type args struct {

pkg/controller/postgresql/grant/reconciler.go

@@ -87,7 +87,7 @@ func Setup(mgr ctrl.Manager, l logging.Logger) error {
 type connector struct {
 	kube  client.Client
 	usage resource.Tracker
-	newDB func(creds map[string][]byte, database string) xsql.DB
+	newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 }
 
 func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
@@ -120,7 +120,7 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 		return nil, errors.Wrap(err, errGetSecret)
 	}
 	return &external{
-		db:   c.newDB(s.Data, pc.Spec.DefaultDatabase),
+		db:   c.newDB(s.Data, pc.Spec.DefaultDatabase, pc.Spec.SSLMode),
 		kube: c.kube,
 	}, nil
 }

pkg/controller/postgresql/grant/reconciler_test.go

@@ -68,7 +68,7 @@ func TestConnect(t *testing.T) {
 	type fields struct {
 		kube  client.Client
 		usage resource.Tracker
-		newDB func(creds map[string][]byte, database string) xsql.DB
+		newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 	}
 
 	type args struct {

pkg/controller/postgresql/role/reconciler.go

@@ -84,7 +84,7 @@ func Setup(mgr ctrl.Manager, l logging.Logger) error {
 type connector struct {
 	kube  client.Client
 	usage resource.Tracker
-	newDB func(creds map[string][]byte, database string) xsql.DB
+	newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 }
 
 func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.ExternalClient, error) {
@@ -118,7 +118,7 @@ func (c *connector) Connect(ctx context.Context, mg resource.Managed) (managed.E
 	}
 
 	return &external{
-		db:   c.newDB(s.Data, pc.Spec.DefaultDatabase),
+		db:   c.newDB(s.Data, pc.Spec.DefaultDatabase, pc.Spec.SSLMode),
 		kube: c.kube,
 	}, nil
 }

pkg/controller/postgresql/role/reconciler_test.go

@@ -74,7 +74,7 @@ func TestConnect(t *testing.T) {
 	type fields struct {
 		kube  client.Client
 		usage resource.Tracker
-		newDB func(creds map[string][]byte, database string) xsql.DB
+		newDB func(creds map[string][]byte, database string, sslmode string) xsql.DB
 	}
 
 	type args struct {