Mount PostgreSQL SSL certificates in Praefect

Yarra Vivekrequested to merge
gitlab-community/gitlab-org/charts/gitlab:5989-mount-praefect-psql-ssl into master

What does this MR do?

Mounts the PostgreSQL SSL certificate volume in the Praefect StatefulSet and configures Praefect's [database] connection to read the mounted client certificate, client key, and server CA.

The Geo tracking database is separate from Praefect, so its SSL volume is deliberately not mounted in the Praefect pod.

Related issues

Closes #5989 (closed)

Verification

  • Rendered the Praefect ConfigMap and StatefulSet with Helm 4.2.3.
  • Confirmed sslcert, sslkey, and sslrootcert point to the files under /etc/postgresql/ssl/.
  • Confirmed the primary PostgreSQL SSL secret is mounted in the Praefect container.
  • Rendered a Geo secondary with both primary and Geo PostgreSQL SSL settings and confirmed the Geo tracking-database secret is absent from the Praefect pod.
  • Added focused RSpec coverage for the database configuration, mount, and volume.
  • git diff --check

Author's checklist

  • MR title and description are accurate and descriptive.
  • MR targets master.
  • The change follows the existing PostgreSQL SSL helper pattern.
  • MR has a green pipeline on GitLab.com.
  • MR is labeled workflow::ready for review when the pipeline is green.

Review checklist

  • Maintainer review completed.
  • Release milestone set.
Edited by Nailia Iskhakova

Merge request reports