High Availability - Postgresql

[itmwiw]

Hello,
I'd like to run smallstep certificates in HA mode. I've read the documentation and it says I should use Mysql as a Database. My question is: why not Postgresql? I see that it is supported here: https://smallstep.com/docs/step-ca/configuration#postgresql
Is there any reason why you recommend Mysql and not Postgresql?
Thanks in advance
Regards,
Tarik

[maraino]

MySQL support has been there for a long time, the recommendation was probably written when there was no PostgreSQL support.

[itmwiw]

Ok thanks @maraino! I'll go with Postgresql then.

[tashian]

I'll update the docs on this.

[itmwiw]

By the way, I'm deploying Smallstep on Kubernetes using the official Chart and ArgoCD. The only way I can think of, for configuring Smallstep is here -> https://github.com/smallstep/helm-charts/blob/master/step-certificates/values.yaml#L78
However, this means I'll have the database password on a GitHub repository, which is not recommended. Is it possible to use an existing secret for the database (and keep inject section)?
I'm aware of the existingSecrets.configAsSecret, but I would like to keep the configuration Git-ops oriented if possible.
Thanks

[maraino]

You should be able to configure some environment variables using .Values.ca.env, see this or mount extra volumes with .Values.extraVolumeMounts and .Values.extraVolumes.

The password one can be passed with PGPASSWORD or if you mount it as a volume as PGPASSFILE. You can see other environment variables here.

[itmwiw]

Yes, I think that would do the trick. Thanks for the hint @maraino !
I may need an initContainer to prepare the PGPASSFILE (I prefer this option over PGPASSWORD). If it's ok with you I can add something like this in a PR:

ca:
  ## extraInitContainers:
  ##   - name: do-something
  ##     image: busybox
  ##     command: ['do', 'something']
  ##
  extraInitContainers: []

and then in the ca.yaml:

      {{- if or (and .Release.IsInstall (not (or .Values.inject.enabled .Values.existingSecrets.enabled ))) .Values.extraInitContainers }}
      initContainers:
        {{- if and .Release.IsInstall (not (or .Values.inject.enabled .Values.existingSecrets.enabled )) }}
        - name: {{ .Chart.Name }}-init
          image: {{ .Values.image.initContainerRepository }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["sleep", "20"]
          {{- with .Values.ca.init.containerSecurityContext }}
          securityContext:
            {{- toYaml . | nindent 12 }}
          {{- end }}
        {{- end }}
        {{- with .Values.extraInitContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- end }}

It may be useful for other stuff as well.
EDIT: I used the pg cloudnativePG operator to provision Smallstep Database and it generates a secret containing the pgpass. Now everything works fine with no need for an initContainer. I can still create the PR if you think it may be useful for something else.

[maraino]

Sure, just add the new attribute at the top of the values instead of under ca

[itmwiw]

Done

[maraino]

And released.