Adding support for certificate authentication + adding support for specifying tags

REFERENCE.md

@@ -48,8 +48,18 @@ The following parameters are available in the `patroni` class:
 * [`bootstrap_post_init`](#-patroni--bootstrap_post_init)
 * [`superuser_username`](#-patroni--superuser_username)
 * [`superuser_password`](#-patroni--superuser_password)
+* [`superuser_sslmode`](#-patroni--superuser_sslmode)
+* [`superuser_sslkey`](#-patroni--superuser_sslkey)
+* [`superuser_sslpassword`](#-patroni--superuser_sslpassword)
+* [`superuser_sslcert`](#-patroni--superuser_sslcert)
+* [`superuser_sslrootcert`](#-patroni--superuser_sslrootcert)
 * [`replication_username`](#-patroni--replication_username)
 * [`replication_password`](#-patroni--replication_password)
+* [`replication_sslmode`](#-patroni--replication_sslmode)
+* [`replication_sslkey`](#-patroni--replication_sslkey)
+* [`replication_sslpassword`](#-patroni--replication_sslpassword)
+* [`replication_sslcert`](#-patroni--replication_sslcert)
+* [`replication_sslrootcert`](#-patroni--replication_sslrootcert)
 * [`callback_on_reload`](#-patroni--callback_on_reload)
 * [`callback_on_restart`](#-patroni--callback_on_restart)
 * [`callback_on_role_change`](#-patroni--callback_on_role_change)
@@ -133,6 +143,7 @@ The following parameters are available in the `patroni` class:
 * [`ctl_certfile`](#-patroni--ctl_certfile)
 * [`ctl_keyfile`](#-patroni--ctl_keyfile)
 * [`ctl_keyfile_password`](#-patroni--ctl_keyfile_password)
+* [`tags`](#-patroni--tags)
 * [`manage_postgresql`](#-patroni--manage_postgresql)
 * [`postgresql_version`](#-patroni--postgresql_version)
 * [`package_name`](#-patroni--package_name)
@@ -351,36 +362,116 @@ Default value: `undef`
 
 ##### <a name="-patroni--superuser_username"></a>`superuser_username`
 
-Data type: `String`
+Data type: `String[1]`
 
 Refer to PostgreSQL configuration settings superuser username
 
 Default value: `'postgres'`
 
 ##### <a name="-patroni--superuser_password"></a>`superuser_password`
 
-Data type: `String`
+Data type: `String[1]`
 
 Refer to PostgreSQL configuration settings superuser password
 
 Default value: `'changeme'`
 
+##### <a name="-patroni--superuser_sslmode"></a>`superuser_sslmode`
+
+Data type: `Optional[Enum['disable','allow','prefer','require','verify-ca','verify-full']]`
+
+Refer to PostgreSQL configuration setting superuser sslmode
+
+Default value: `undef`
+
+##### <a name="-patroni--superuser_sslkey"></a>`superuser_sslkey`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting superuser sslkey
+
+Default value: `undef`
+
+##### <a name="-patroni--superuser_sslpassword"></a>`superuser_sslpassword`
+
+Data type: `Optional[String[1]]`
+
+Refer to PostgreSQL configuration setting superuser sslpassword
+
+Default value: `undef`
+
+##### <a name="-patroni--superuser_sslcert"></a>`superuser_sslcert`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting superuser sslcert
+
+Default value: `undef`
+
+##### <a name="-patroni--superuser_sslrootcert"></a>`superuser_sslrootcert`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting superuser sslrootcert
+
+Default value: `undef`
+
 ##### <a name="-patroni--replication_username"></a>`replication_username`
 
-Data type: `String`
+Data type: `String[1]`
 
 Refer to PostgreSQL configuration settings replication username
 
 Default value: `'rep_user'`
 
 ##### <a name="-patroni--replication_password"></a>`replication_password`
 
-Data type: `String`
+Data type: `String[1]`
 
 Refer to PostgreSQL configuration settings replication password
 
 Default value: `'changeme'`
 
+##### <a name="-patroni--replication_sslmode"></a>`replication_sslmode`
+
+Data type: `Optional[Enum['disable','allow','prefer','require','verify-ca','verify-full']]`
+
+Refer to PostgreSQL configuration setting replication sslmode
+
+Default value: `undef`
+
+##### <a name="-patroni--replication_sslkey"></a>`replication_sslkey`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting replication sslkey
+
+Default value: `undef`
+
+##### <a name="-patroni--replication_sslpassword"></a>`replication_sslpassword`
+
+Data type: `Optional[String[1]]`
+
+Refer to PostgreSQL configuration setting replication sslpassword
+
+Default value: `undef`
+
+##### <a name="-patroni--replication_sslcert"></a>`replication_sslcert`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting replication sslcert
+
+Default value: `undef`
+
+##### <a name="-patroni--replication_sslrootcert"></a>`replication_sslrootcert`
+
+Data type: `Optional[Stdlib::Absolutepath]`
+
+Refer to PostgreSQL configuration setting replication sslrootcert
+
+Default value: `undef`
+
 ##### <a name="-patroni--callback_on_reload"></a>`callback_on_reload`
 
 Data type: `Optional[String]`
@@ -1045,6 +1136,14 @@ Refer to CTL configuration `keyfile_password` setting
 
 Default value: `undef`
 
+##### <a name="-patroni--tags"></a>`tags`
+
+Data type: `Hash`
+
+Refer to Tags setting, this is a hash which will contain all tags that should be added
+
+Default value: `{}`
+
 ##### <a name="-patroni--manage_postgresql"></a>`manage_postgresql`
 
 Data type: `Boolean`

manifests/init.pp

@@ -50,10 +50,30 @@
 #   Refer to PostgreSQL configuration settings superuser username
 # @param superuser_password
 #   Refer to PostgreSQL configuration settings superuser password
+# @param superuser_sslmode
+#   Refer to PostgreSQL configuration setting superuser sslmode
+# @param superuser_sslkey
+#   Refer to PostgreSQL configuration setting superuser sslkey
+# @param superuser_sslpassword
+#   Refer to PostgreSQL configuration setting superuser sslpassword
+# @param superuser_sslcert
+#   Refer to PostgreSQL configuration setting superuser sslcert
+# @param superuser_sslrootcert
+#   Refer to PostgreSQL configuration setting superuser sslrootcert
 # @param replication_username
 #   Refer to PostgreSQL configuration settings replication username
 # @param replication_password
 #   Refer to PostgreSQL configuration settings replication password
+# @param replication_sslmode
+#   Refer to PostgreSQL configuration setting replication sslmode
+# @param replication_sslkey
+#   Refer to PostgreSQL configuration setting replication sslkey
+# @param replication_sslpassword
+#   Refer to PostgreSQL configuration setting replication sslpassword
+# @param replication_sslcert
+#   Refer to PostgreSQL configuration setting replication sslcert
+# @param replication_sslrootcert
+#   Refer to PostgreSQL configuration setting replication sslrootcert
 # @param callback_on_reload
 #   Refer to PostgreSQL configuration settings callbacks `on_reload`
 # @param callback_on_restart
@@ -220,6 +240,8 @@
 #   Refer to CTL configuration `keyfile` setting
 # @param ctl_keyfile_password
 #   Refer to CTL configuration `keyfile_password` setting
+# @param tags
+#   Refer to Tags setting, this is a hash which will contain all tags that should be added
 # @param manage_postgresql
 #   Boolean to determine if postgresql is managed
 # @param postgresql_version
@@ -313,10 +335,20 @@
   String[1] $standby_cluster_primary_slot_name = 'patroni',
 
   # PostgreSQL Settings
-  String $superuser_username = 'postgres',
-  String $superuser_password = 'changeme',
-  String $replication_username = 'rep_user',
-  String $replication_password = 'changeme',
+  String[1] $superuser_username = 'postgres',
+  String[1] $superuser_password = 'changeme',
+  Optional[Enum['disable','allow','prefer','require','verify-ca','verify-full']] $superuser_sslmode = undef,
+  Optional[Stdlib::Absolutepath] $superuser_sslkey = undef,
+  Optional[String[1]] $superuser_sslpassword = undef,
+  Optional[Stdlib::Absolutepath] $superuser_sslcert = undef,
+  Optional[Stdlib::Absolutepath] $superuser_sslrootcert = undef,
+  String[1] $replication_username = 'rep_user',
+  String[1] $replication_password = 'changeme',
+  Optional[Enum['disable','allow','prefer','require','verify-ca','verify-full']] $replication_sslmode = undef,
+  Optional[Stdlib::Absolutepath] $replication_sslkey = undef,
+  Optional[String[1]] $replication_sslpassword = undef,
+  Optional[Stdlib::Absolutepath] $replication_sslcert = undef,
+  Optional[Stdlib::Absolutepath] $replication_sslrootcert = undef,
   Optional[String] $callback_on_reload = undef,
   Optional[String] $callback_on_restart = undef,
   Optional[String] $callback_on_role_change = undef,
@@ -417,6 +449,9 @@
   Optional[String[1]] $ctl_keyfile = undef,
   Optional[String[1]] $ctl_keyfile_password = undef,
 
+  # Tags Settings
+  Hash $tags = {},
+
   # Module Specific Settings
   Boolean $manage_postgresql = true,
   Optional[String[1]] $postgresql_version = undef,

spec/classes/init_spec.rb

@@ -350,6 +350,100 @@
         end
       end
 
+      context 'superuser certificate authentication' do
+        let(:params) do
+          {
+            'scope'                 => 'testscope',
+            'superuser_username'    => 'superuser',
+            'superuser_password'    => 'secretinitpass',
+            'superuser_sslmode'     => 'require',
+            'superuser_sslkey'      => '/var/lib/pgsql/ssl_key.pem',
+            'superuser_sslpassword' => 'secretpass',
+            'superuser_sslcert'     => '/var/lib/pgsql/ssl_cert.pem',
+            'superuser_sslrootcert' => '/var/lib/pgsql/root_cert.pem',
+          }
+        end
+
+        it 'has valid config' do
+          content = catalogue.resource('file', 'patroni_config').send(:parameters)[:content]
+          config = YAML.safe_load(content)
+          expected = {
+            'sslcert'     => '/var/lib/pgsql/ssl_cert.pem',
+            'sslkey'      => '/var/lib/pgsql/ssl_key.pem',
+            'sslmode'     => 'require',
+            'sslpassword' => 'secretpass',
+            'sslrootcert' => '/var/lib/pgsql/root_cert.pem',
+            'username'    => 'superuser',
+            'password'    => 'secretinitpass',
+          }
+          expect(config['postgresql']['authentication']['superuser']).to include(expected)
+        end
+      end
+
+      context 'replication user certificate authentication' do
+        let(:params) do
+          {
+            'scope'                   => 'testscope',
+            'replication_username'    => 'replication',
+            'replication_password'    => 'secretinitpass',
+            'replication_sslmode'     => 'require',
+            'replication_sslkey'      => '/var/lib/pgsql/ssl_key.pem',
+            'replication_sslpassword' => 'secretpass',
+            'replication_sslcert'     => '/var/lib/pgsql/ssl_cert.pem',
+            'replication_sslrootcert' => '/var/lib/pgsql/root_cert.pem',
+          }
+        end
+
+        it 'has valid config' do
+          content = catalogue.resource('file', 'patroni_config').send(:parameters)[:content]
+          config = YAML.safe_load(content)
+          expected = {
+            'username'    => 'replication',
+            'password'    => 'secretinitpass',
+            'sslmode'     => 'require',
+            'sslkey'      => '/var/lib/pgsql/ssl_key.pem',
+            'sslpassword' => 'secretpass',
+            'sslcert'     => '/var/lib/pgsql/ssl_cert.pem',
+            'sslrootcert' => '/var/lib/pgsql/root_cert.pem'
+          }
+          expect(config['postgresql']['authentication']['replication']).to include(expected)
+        end
+      end
+
+      context 'tags' do
+        let(:params) do
+          {
+            'scope' => 'testscope',
+            'tags'  => {
+              'boolean_true'      => true,
+              'boolean_false'     => false,
+              'integer'           => 69,
+              'integer_as_string' => '69',
+              'float'             => 1.1,
+              'float_as_string'   => '1.1',
+              'string'            => 'simple',
+              'string_long'       => 'long string with spaces'
+            }
+          }
+        end
+
+        it 'has valid config' do
+          content = catalogue.resource('file', 'patroni_config').send(:parameters)[:content]
+          config = YAML.safe_load(content)
+          expected = {
+            'boolean_true'      => true,
+            'boolean_false'     => false,
+            'integer'           => 69,
+            'integer_as_string' => 69,
+            'float'             => 1.1,
+            'float_as_string'   => 1.1,
+            'string'            => 'simple',
+            'string_long'       => 'long string with spaces'
+          }
+          expect(config['tags']).to include(expected)
+        end
+      end
+
       context 'install_method => package' do
         let(:params) { { 'scope' => 'testscope', 'install_method' => 'package' } }
 

templates/postgresql.yml.erb

@@ -89,9 +89,39 @@ postgresql:
     superuser:
       username: <%= @superuser_username %>
       password: '<%= @superuser_password %>'
+<% if @superuser_sslmode -%>
+      sslmode: <%= @superuser_sslmode %>
+<% end -%>
+<% if @superuser_sslkey -%>
+      sslkey: <%= @superuser_sslkey %>
+<% end -%>
+<% if @superuser_sslpassword -%>
+      sslpassword: '<%= @superuser_sslpassword %>'
+<% end -%>
+<% if @superuser_sslcert -%>
+      sslcert: <%= @superuser_sslcert %>
+<% end -%>
+<% if @superuser_sslrootcert -%>
+      sslrootcert: <%= @superuser_sslrootcert %>
+<% end -%>
     replication:
       username: <%= @replication_username %>
       password: '<%= @replication_password %>'
+<% if @replication_sslmode -%>
+      sslmode: <%= @replication_sslmode %>
+<% end -%>
+<% if @replication_sslkey -%>
+      sslkey: <%= @replication_sslkey %>
+<% end -%>
+<% if @replication_sslpassword -%>
+      sslpassword: '<%= @replication_sslpassword %>'
+<% end -%>
+<% if @replication_sslcert -%>
+      sslcert: <%= @replication_sslcert %>
+<% end -%>
+<% if @replication_sslrootcert -%>
+      sslrootcert: <%= @replication_sslrootcert %>
+<% end -%>
 <% unless @callback_on_reload == nil && @callback_on_restart == nil && @callback_on_role_change == nil && @callback_on_start == nil && @callback_on_stop == nil -%>
   callbacks:
 <% if @callback_on_reload != nil -%>
@@ -315,3 +345,9 @@ consul:
   service_check_interval: <%= @consul_service_check_interval %>
 <% end -%>
 <% end -%>
+<% unless @tags.empty? -%>
+tags:
+<% @tags.each do |name,val| -%>
+  <%= name -%>: <%= val %>
+<% end -%>
+<% end -%>