Skip to content

Upgrade audit to v1.77.1

History is in the CHANGELOG.

Breaking changes

Every audit connection to Postgres goes through the truvity/cnpg client. It accepts one TLS mode, and it reads the CA and the password from files.

  • sslmode is verify-full, or absent, with a CA file named by sslrootcert= in the URL or by PGSSLROOTCERT. sslmode=require is refused when the file loads.
  • The host in the URL is a name the server certificate carries. For a CloudNativePG cluster that is its -rw Service.
  • passwordSecret needs secrets.source: file. The ssm and env sources, and a version 1 passwordEnv, are refused when the file loads.
  • A URL parameter the client does not use (passfile, host, options) and a second host are refused when the process starts.

The client reads the CA, the certificate and the password again for every new connection. A rotated Secret is in use within 30 minutes, with no restart.

Steps

  1. Check the server certificate. openssl s_client -connect <host>:5432 -starttls postgres -CAfile <ca.crt> -verify_hostname <host> ends with Verify return code: 0 (ok).
  2. Put the CA that signed it in a ConfigMap, and set trust.configMap and trust.key in the chart's values. The chart mounts it on every pod at /etc/audit/trust.
  3. In each database.url, add sslmode=verify-full&sslrootcert=/etc/audit/trust/<key>.
  4. Replace secretEnv with secretFiles, and set secrets: {source: file, root: /etc/audit/secrets}.
  5. Apply the change with the current version first. It works there, so a failure is not mixed with the upgrade.
  6. Upgrade the chart and the images.

Verify

audit-observe and audit-query become ready, and the migrate Job completes. A pod that logs sslmode ... is refused or the server CA file is required has a URL from step 3 missing.

Roll back

Roll back to v1.77.0 with the same documents. The URLs and files above work there too.