mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-10-26 07:23:59 +08:00
Jeremy Alvis
df788825e6
## Summary Part of: #2097 Bundled PostgreSQL currently accepts any client certificate signed by the pod-identity CA without binding it to the requested database username. Require certificate authentication with a common name matching the login, using a dedicated PostgreSQL client CA. - Add a pod-certificate signer restricted to `ate-system` pods using the `ate-api-server` service account. It issues only the two permitted identities: `substrate_owner_user` and `substrate_readwrite_user`. - Project separate certificates for the owner and runtime connections. Configure passwordless connection strings with server certificate verification, and retain the existing owner/runtime role grants. - Have `ate-setup` provision the CA and configure bundled PostgreSQL automatically, including on an existing installation. Disable passwords on the bundled application users and keep administrator access local to the PostgreSQL pod. - Reuse existing rotation support: new database connections from ateapi reread projected credentials and trust roots, while the bundled PostgreSQL TLS-reloader detects server-certificate or client-trust-bundle changes every 60 seconds and requests a configuration reload. External PostgreSQL and Cloud SQL continue to use their configured connection strings and authentication settings. Both application certificates are available to the API-server process; separate credentials preserve database role separation but do not isolate the roles from a compromised API server. ## Validation - Passed `go test -race ./cmd/podcertcontroller/... ./cmd/ate-setup/... ./cmd/ateapi/internal/store/atepg ./pkg/postgressetup ./internal/installdefaults` after rebasing onto updated main. - Signer tests cover both allowed identities, unauthorized requests, pod identity checks, certificate lifetimes, and trust bundles. - Docker integration tests use the bundled PostgreSQL configuration and verify successful passwordless connections, bootstrap/migrations, and runtime operations. They reject mismatched usernames, untrusted certificates, missing certificates, remote administrator access, plaintext connections, and runtime access to owner privileges.