Fixes #10234 - Postgres SSL Certificate fix (#10300)

Signed-off-by: Rajshekar Reddy <reddymh@gmail.com>

Dockerfile

@@ -101,6 +101,8 @@ FROM gcr.io/distroless/static as workflow-controller
 
 USER 8737
 
+WORKDIR /home/argo
+
 COPY hack/ssh_known_hosts /etc/ssh/
 COPY hack/nsswitch.conf /etc/
 COPY --chown=8737 --from=workflow-controller-build /go/src/github.com/argoproj/argo-workflows/dist/workflow-controller /bin/

config/config.go

@@ -232,8 +232,19 @@ func (c DatabaseConfig) GetHostname() string {
 
 type PostgreSQLConfig struct {
  DatabaseConfig
- SSL bool `json:"ssl,omitempty"`
- SSLMode string `json:"sslMode,omitempty"`
+ SSL bool `json:"ssl,omitempty"`
+ SSLMode string `json:"sslMode,omitempty"`
+ CaCertSecret apiv1.SecretKeySelector `json:"caCertSecret,omitempty"`
+ ClientCertSecret apiv1.SecretKeySelector `json:"clientCertSecret,omitempty"`
+ ClientKeySecret apiv1.SecretKeySelector `json:"clientKeySecret,omitempty"`
+ CertPath string `json:"certPath"`
+}
+
+func (c PostgreSQLConfig) GetPGCertPath() string {
+ if c.CertPath != "" {
+ return c.CertPath
+ }
+ return "/home/argo/pgcerts"
 }
 
 type MySQLConfig struct {

persist/sqldb/sqldb.go

@@ -3,6 +3,7 @@ package sqldb
 import (
  "context"
  "fmt"
+ "os"
  "time"
 
  "k8s.io/client-go/kubernetes"
@@ -53,9 +54,43 @@ func CreatePostGresDBSession(kubectlConfig kubernetes.Interface, namespace strin
  }
 
  if cfg.SSL {
- if cfg.SSLMode != "" {
+ if cfg.SSLMode != "" && cfg.SSLMode != "disable" {
+ err := os.MkdirAll(cfg.GetPGCertPath(), 0700)
+ if err != nil {
+ return nil, "", err
+ }
+ rootCertByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.CaCertSecret.Name, cfg.CaCertSecret.Key)
+ if err != nil {
+ return nil, "", err
+ }
+ err = os.WriteFile(cfg.GetPGCertPath()+"/ca.crt", rootCertByte, 0600)
+ if err != nil {
+ return nil, "", err
+ }
+
+ serverCertByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.ClientCertSecret.Name, cfg.ClientCertSecret.Key)
+ if err != nil {
+ return nil, "", err
+ }
+ err = os.WriteFile(cfg.GetPGCertPath()+"/tls.crt", serverCertByte, 0600)
+ if err != nil {
+ return nil, "", err
+ }
+
+ serverKeyByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.ClientKeySecret.Name, cfg.ClientKeySecret.Key)
+ if err != nil {
+ return nil, "", err
+ }
+ err = os.WriteFile(cfg.GetPGCertPath()+"/tls.key", serverKeyByte, 0400)
+ if err != nil {
+ return nil, "", err
+ }
+
  options := map[string]string{
- "sslmode": cfg.SSLMode,
+ "sslmode": cfg.SSLMode,
+ "sslrootcert": cfg.GetPGCertPath() + "/ca.crt",
+ "sslkey": cfg.GetPGCertPath() + "/tls.key",
+ "sslcert": cfg.GetPGCertPath() + "/tls.crt",
  }
  settings.Options = options
  }