Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explain HBA rules in their field description #4141

Merged
merged 2 commits into from
Mar 21, 2025

Conversation

cbandy
Copy link
Member

@cbandy cbandy commented Mar 20, 2025

Checklist:

  • Have you added an explanation of what your changes do and why you'd like them to be included?
  • Have you updated or added documentation for the change, as applicable?
  • Have you tested your changes on all related environments with successful results, as applicable?
    • Have you added automated tests?

Type of Changes:

  • Documentation

What is the current behavior (link to any open issues here)?

These fields have no description at all.

What is the new behavior (if this is a feature change)?

$ kubectl explain PostgresCluster.spec.authentication.rules

GROUP:      postgres-operator.crunchydata.com
KIND:       PostgresCluster
VERSION:    v1beta1

FIELD: rules <[]Object>


DESCRIPTION:
    Postgres compares every new connection to these rules in the order they are
    defined. The first rule that matches determines if and how the connection
    must then authenticate. Connections that match no rules are disconnected.
    
    When this is omitted or empty, Postgres accepts encrypted connections to any
    database from users that have a password. To refuse all network connections,
    set this to one rule that matches "host" connections to the "reject" method.
    
    More info: https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
    
FIELDS:
  connection	<string>
    The connection transport this rule matches. Typical values are:
     1. "host" for network connections that may or may not be encrypted.
     2. "hostssl" for network connections encrypted using TLS.
     3. "hostgssenc" for network connections encrypted using GSSAPI.

  databases	<[]string>
    Which databases this rule matches. When omitted or empty, this rule matches
    all databases.

  hba	<string>
    One line of the "pg_hba.conf" file. Changes to this value will be
    automatically reloaded without validation.

  method	<string>
    The authentication method to use when a connection matches this rule.
    The special value "reject" refuses connections that match this rule.
    
    More info: https://www.postgresql.org/docs/current/auth-methods.html

  options	<map[string]Object>
    Additional settings for this rule or its authentication method.

  users	<[]string>
    Which user names this rule matches. When omitted or empty, this rule matches
    all users.

Other Information:

Issue: PGO-2263

@cbandy cbandy requested a review from andrewlecuyer March 20, 2025 16:52
@cbandy
Copy link
Member Author

cbandy commented Mar 20, 2025

I created https://issue.k8s.io/130946 for that options <map[string]Object>.

Copy link
Contributor

@tony-landreth tony-landreth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@cbandy cbandy merged commit bc02379 into CrunchyData:main Mar 21, 2025
19 checks passed
@cbandy cbandy deleted the authn-docs branch March 21, 2025 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants