reload PGBouncer when certificates change#20
Conversation
boddumanohar
changed the title
| ( | ||
| while true; do | ||
| inotifywait -e modify,create,delete,move,attrib /vela/certs | ||
| echo "Certificates modified, reloading PgBouncer..." |
There was a problem hiding this comment.
Have you made sure there isn't any weird behavior which may reload this endlessly? Like the attributes (for example modification or access time) updating constantly?
There was a problem hiding this comment.
let me check and get back on this
There was a problem hiding this comment.
updated the logic to also compare the checksums. And also to make the VM backward compatible, I've added the check to look for certificates only when client_tls_sslmode=require in the Postgres configuration.
boddumanohar
force-pushed
the
hotreload-certs
branch
from
6dcf729 to
a574a69
Compare
boddumanohar
force-pushed
the
hotreload-certs
branch
from
a574a69 to
eaad870
Compare
mxsrc
left a comment
mxsrc
left a comment
There was a problem hiding this comment.
I realize you implemented the checksum comparison to accommodate chris' comment, I think it's not necessary. Iirc, the modify events don't trigger on metadata, so adding a short sleep after reloading should be sufficient to avoid the concern. Or did you see other behavior in your testing?
| ( | ||
| last_checksum="" | ||
| while true; do | ||
| inotifywait -e modify,create,delete,move /vela/certs > /dev/null 2>&1 |
There was a problem hiding this comment.
Are the events correct here? I imagine that if something accidentally deletes or moves tls.{key,crt}, the script will fail. Can we only wait for the actual files we use, and for modify events or does something speak against that?
There was a problem hiding this comment.
I think it's a good idea to look for modifications to the files /vela/certs/tls.key and /vela/certs/tls.crt only. Instead of the entire folder
EDIT: Tried this didn't work. Probably due to the fact that k8s secrets are symlinks to an other folder.
There was a problem hiding this comment.
If the files are accidentally deleted, the loop triggers and sends SIGHUP to PGBouncer. But PgBouncer logs an error but keeps running with the old (currently loaded in-memory) configuration and certificates.
So I guess it's okay delete part of the event.
There was a problem hiding this comment.
That makes sense, thanks for checking. Could you maybe this as a comment to avoid confusion?
boddumanohar
force-pushed
the
hotreload-certs
branch
from
eaad870 to
57aa934
Compare
|
I don't have a way to test out Chris' comment. So I've removed |
|
Great, good to go from my end, just the comment about the comment would be still nice to have :) |
3 participants
Changes
inotify-toolsclient_tls_sslmode = requireis enabled on the configuration file, the files/vela/certs/tls.keyand/vela/certs/tls.crtare required to start PGBouncer./vela/certstesting
Have manually rotated the certificate and PGBouncer got reloaded when the certificate changed