enable-tls-cloud-controller-postgres.yml

---
- type: replace
  path: /instance_groups/name=database/jobs/name=postgres/properties/databases/tls?
  value:
    ca: "((postgres_tls.ca))"
    certificate: "((postgres_tls.certificate))"
    private_key: "((postgres_tls.private_key))"

- type: replace
  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/ccdb/address?
  value: sql-db.service.cf.internal

- type: replace
  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/ccdb/ca_cert?
  value: "((postgres_tls.ca))"

- type: replace
  path: /instance_groups/name=cc-worker/jobs/name=cloud_controller_worker/properties/ccdb/address?
  value: sql-db.service.cf.internal

- type: replace
  path: /instance_groups/name=cc-worker/jobs/name=cloud_controller_worker/properties/ccdb/ca_cert?
  value: "((postgres_tls.ca))"

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=cloud_controller_clock/properties/ccdb/address?
  value: sql-db.service.cf.internal

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=cloud_controller_clock/properties/ccdb/ca_cert?
  value: "((postgres_tls.ca))"

- type: replace
  path: /variables/name=postgres_ca?
  value:
    name: postgres_ca
    type: certificate
    options:
      is_ca: true
      common_name: postgres_ca

- type: replace
  path: /variables/name=postgres_tls?
  value:
    name: postgres_tls
    type: certificate
    options:
      ca: postgres_ca
      common_name: sql-db.service.cf.internal
      extended_key_usage:
      - server_auth