Add Support for Custom TLS Certificates in Connection Pooler

[borchero]

Fixes #1230
Dockerfile for new pgBouncer image: https://github.com/borchero/pgbouncer

[FxKu]

Thank @borchero for your contribution. We have just merged the inherited annotation feature to allow passing annotations from the postgres manifest down to child resources. You can also use the downscaler_annotations option to only inherit annotations to the deployment and statefulset. I think, you can use this rather than adding yet another field. Could you strip back this PR then to only the TLS passing to pooler?

[borchero]

Removing pooler-specific annotations is a hacky solution imo. The reason for these annotations is to allow external operators to reload the pooler Pods once the TLS secret changes. When using downscaler_annotations, my understanding is that these annotations are also added to the Postgres StatefulSet.

Unfortunately, this means that these "reloading" annotations also trigger a redeploy of the Postgres Pods although they handle hot reloading internally.

[Jan-M]

@borchero I would like to see this added to the operator config, don#t you agree? this seems like a potential global config for all poolers?

[borchero]

Yes, that sounds reasonable. So can I update the PR with pooler specific annotations in the operator config?

[FxKu]

Sure, you can add it here.

There are a few more places where you have to reflect the change. See our short docs on this topic.

[bchrobot]

This is a feature we are interested in. @borchero do you still have plans to work on this at some point? If not, I would be happy to take a stab at rebasing on master and making the requested changes for pooler annotations.

[borchero]

Hey @bchrobot I don't currently need the functionality anymore, so I'm unlikely to work on it soon ... feel free to take over!

[Dayde]

Really interested in this too, in fact we consider it to be more a bugfix than a feature as we can’t use MTLS through pgBouncer because of this.
Looking at the two years old comments @FxKu I’m not sure what is still to be done.
@bchrobot have you already start to work on that ? We’re gonna need that soon and we’d be glad to lend a hand.

[Dayde]

Should I open another PR ? I’ve rebased the branch but I can’t push it here.
A brief sum up of what’s left to do in your opinion would be really nice 🙏

[bchrobot]

@bchrobot have you already start to work on that ? We’re gonna need that soon and we’d be glad to lend a hand.

I have not made any progress and will not have time to work on this until November. A new PR is probably the easiest path forward.

[borchero]

Closing this in favor of #2146.