feat: implement endpointCA certificate mounting for TLS verification - #141
Merged
Agalin merged 3 commits intoAug 21, 2026
Merged
Conversation
Agalin
requested changes
Aug 20, 2026
The endpointCA field was defined in the CRD and the PGBACKREST_REPO<N>_HOST_CA_FILE env var was injected, but the CA certificate was never written to the file the env var pointed at, and the env var name was wrong (HOST_CA_FILE instead of STORAGE_CA_FILE). This left pgBackRest unable to verify self-signed S3 endpoints, failing with 'unable to get local issuer certificate'. Changes: - writeEndpointCACertificate: new function in credentials.go that reads the EndpointCA Kubernetes Secret (via the existing extractValueFromSecret helper) and writes the CA cert to /controller/certificates/ before pgBackRest runs. Called from both EnvSetBackupCloudCredentials (backup + WAL archive paths) and EnvSetRestoreCloudCredentials (restore path), covering all code paths that invoke pgBackRest. - Fix env var name: changed HOST_CA_FILE to STORAGE_CA_FILE, the correct pgBackRest env var for S3 storage CA verification (maps to --repo<N>-storage-ca-file). The previous HOST_CA_FILE maps to --repo<N>-host-ca-file, which is for remote pgBackRest server TLS, not S3 storage. - Fix restore CA path: EnvSetRestoreCloudCredentials was using BarmanBackupEndpointCACertificateLocation (the backup path) instead of BarmanRestoreEndpointCACertificateLocation (the restore path). Now correct. - RBAC: include endpointCA Secret: new CollectSecretNamesFromRepositories in secrets.go collects EndpointCA and EncryptionKey Secret names from repository configs. BuildRole in role.go calls it alongside the existing CollectSecretNamesFromCredentials, adding the CA Secret name to the per-namespace Role's resourceNames so the sidecar's service account can read it. - Remove stale TODO: removed the 'TODO: Properly mount/read and pass CA file for each pgbackrest repository.' comment; it is now implemented. Signed-off-by: Thomas Sauvage <thomas-commits@sauvage.pm>
…acy barman-cloud env vars Replace single CA certificate file paths with per-repository paths so each repository gets its own CA file. Remove GetRestoreCABundleEnv and MergeEnv from common.go, which set AWS_CA_BUNDLE (a barman-cloud legacy env var that pgBackRest does not read). Fix WAL restore to use EnvSetRestoreCloudCredentials instead of EnvSetBackupCloudCredentials. Signed-off-by: Thomas Sauvage <thomas-commits@sauvage.pm>
ThomasSauvage
force-pushed
the
feat/endpoint-ca-certificate-mounting
branch
from
August 21, 2026 09:47
b113cd8 to
cf0b709
Compare
Agalin
requested changes
Aug 21, 2026
Collaborator
|
golangci-lint returns some issues, please fix them to make CI pass. |
…s.go Remove the now-empty common.go file (addressing review feedback). Fix four line-length violations by extracting CA certificate paths into local variables. Signed-off-by: Thomas Sauvage <thomas-commits@sauvage.pm>
Contributor
Author
It should be good now. |
Collaborator
|
FYI: Assuming tests pass I'm going to squash merge this one (to ensure proper changelog entries). |
Agalin
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hello everyone! This is my first PR here! Please don't hesitate if you have any feedback.
The
endpointCAfield was defined in the CRD and thePGBACKREST_REPO<N>_HOST_CA_FILEenv var was injected, but the CA certificate was never written to the file the env var pointed at, and the env var name was wrong (HOST_CA_FILEinstead ofSTORAGE_CA_FILE). This left pgBackRest unable to verify self-signed S3 endpoints, failing withunable to get local issuer certificate.Changes
writeEndpointCACertificate— new function incredentials.gothat reads theEndpointCAKubernetes Secret (via the existingextractValueFromSecrethelper) and writes the CA cert to/controller/certificates/before pgBackRest runs. Called from bothEnvSetBackupCloudCredentials(backup + WAL archive paths) andEnvSetRestoreCloudCredentials(restore path), covering all code paths that invoke pgBackRest.HOST_CA_FILEtoSTORAGE_CA_FILE, the correct pgBackRest env var for S3 storage CA verification (maps to--repo<N>-storage-ca-file). The previousHOST_CA_FILEmaps to--repo<N>-host-ca-file, which is for remote pgBackRest server TLS, not S3 storage.EnvSetRestoreCloudCredentialswas usingBarmanBackupEndpointCACertificateLocation(the backup path) instead ofBarmanRestoreEndpointCACertificateLocation(the restore path). Now correct.CollectSecretNamesFromRepositoriesinsecrets.gocollectsEndpointCAandEncryptionKeySecret names from repository configs.BuildRoleinrole.gocalls it alongside the existingCollectSecretNamesFromCredentials, adding the CA Secret name to the per-namespace Role'sresourceNamesso the sidecar's service account can read it.// TODO: Properly mount/read and pass CA file for each pgbackrest repository.comment; it is now implemented.Notes