From 32e4bc657ab1aa8b0f3103fabca111035846ae8e Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Mon, 2 Nov 2026 13:34:09 +0500
Subject: [PATCH] =?UTF-8?q?uralkal:=20pg-tls=20=E2=80=94=20TLS=20=D0=B8=20?=
 =?UTF-8?q?pg=5Fhba=20=D0=B0=D1=80=D0=B3=D1=83=D0=BC=D0=B5=D0=BD=D1=82?=
 =?UTF-8?q?=D0=B0=D0=BC=D0=B8=20postgres,=20writable=20root=20(=D0=BF.31,?=
 =?UTF-8?q?=20INFRA-3062)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Образ contour/postgresql — официальный postgres с обёрткой contour, bitnami-переменные
TLS и extended-конфиг он игнорирует: ssl, сертификат, ssl_min_protocol_version и
hba_file передаются через -c; readOnlyRootFilesystem: false и пробы pg_isready как у
infrastructure/postgresql/uralkal.
---
 .../postgres-tls-test/uralkal/postgresql.yaml | 36 +++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/apps/postgres-tls-test/uralkal/postgresql.yaml b/apps/postgres-tls-test/uralkal/postgresql.yaml
index 9d5b4b2..b66ec14 100644
--- a/apps/postgres-tls-test/uralkal/postgresql.yaml
+++ b/apps/postgres-tls-test/uralkal/postgresql.yaml
@@ -48,8 +48,40 @@ spec:
         size: 1Gi
       nodeSelector:
         dedicated: generic
-      extendedConfiguration: |
-        ssl_min_protocol_version = 'TLSv1.2'
+      containerSecurityContext:
+        readOnlyRootFilesystem: false
+      args:
+        - postgres
+        - -c
+        - ssl=on
+        - -c
+        - ssl_cert_file=/opt/bitnami/postgresql/certs/tls.crt
+        - -c
+        - ssl_key_file=/opt/bitnami/postgresql/certs/tls.key
+        - -c
+        - ssl_min_protocol_version=TLSv1.2
+        - -c
+        - hba_file=/bitnami/postgresql/conf/pg_hba.conf
+      customLivenessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        failureThreshold: 6
+      customReadinessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        timeoutSeconds: 5
+        failureThreshold: 6
       pgHbaConfiguration: |
         local all all scram-sha-256
         hostssl all all 0.0.0.0/0 scram-sha-256