Move secret configuration for postgresql cluster to a seperate playbook #819
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Remove harcoded repmgr password to k8s secret - Refact postgresql secret management to the secrets playbook - Update the dependency playbooks in the deploy playbook
- Move repmgr and wire-server passwords from inventory to K8s secrets - Create unified postgresql-secrets.yml playbook for all PG credentials - Add runtime validation with helpful error messages in dependent playbooks - Remove hardcoded passwords from group_vars (security improvement) - Update documentation with new tag strategy and password access commands - Simplify wire-setup playbook by removing duplicate secret logic Security improvements: - No hardcoded credentials in version control - Auto-generate 32-character strong passwords - Passwords managed centrally in K8s secrets - Add no_log directive to prevent password exposure in logs Technical details: - Use modern Ansible password lookup syntax with named parameters - Data-driven design with pg_secrets list for easy extensibility - Smart tag grouping (postgresql tag runs secrets + primary + replica) - Fail-fast validation prevents cryptic undefined variable errors
- Update the document with added scenaiors - Fix changelog.d file
julialongtin
reviewed
Nov 3, 2025
ansible/postgresql-deploy.yml
Outdated
| # | ||
| # Usage Examples: | ||
| # Full deployment: ansible-playbook postgresql-deploy.yml | ||
| # Skip cleanup: ansible-playbook postgresql-deploy.yml --skip-tags cleanup |
There was a problem hiding this comment.
if these examples are to be useful, the term before the colon should be a longer explanation than the skip-tags value.
sghosh23
changed the title
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Security improvements:
Technical details:
Change type
Basic information
Testing
Tracking
changelog.dKnowledge Transfer
Motivation
Objective
Reason
Use case