Is there an existing issue already for this feature request/idea?
What problem is this feature going to solve? Why should it be added?
The current implementation of managed roles allows giving the name
of a secret where a role's password will be kept, but that secret is
assumed to exist, and its creation falls on the user.
For users migrating from other solutions, or users wanting to get on
CloudNativePG and have password-protected roles from the get-go,
it would be convenient if the secrets were generated by CloudNativePG
as needed.
See thread https://cloudnativepg.slack.com/archives/C03AX0J5P29/p1706780445388369
Describe the solution you'd like
Allow the managed roles stanza to specify either an existing secret
to hold a role's password, or an auto-generated secret.
Describe alternatives you've considered
at the moment, automatic creation of password secrets would
fall outside of the CNPG envelope
Additional context
No response
Backport?
Yes
Are you willing to actively contribute to this feature?
Yes
Code of Conduct
Is there an existing issue already for this feature request/idea?
What problem is this feature going to solve? Why should it be added?
The current implementation of managed roles allows giving the name
of a secret where a role's password will be kept, but that secret is
assumed to exist, and its creation falls on the user.
For users migrating from other solutions, or users wanting to get on
CloudNativePG and have password-protected roles from the get-go,
it would be convenient if the secrets were generated by CloudNativePG
as needed.
See thread https://cloudnativepg.slack.com/archives/C03AX0J5P29/p1706780445388369
Describe the solution you'd like
Allow the managed roles stanza to specify either an existing secret
to hold a role's password, or an auto-generated secret.
Describe alternatives you've considered
at the moment, automatic creation of password secrets would
fall outside of the CNPG envelope
Additional context
No response
Backport?
Yes
Are you willing to actively contribute to this feature?
Yes
Code of Conduct
I have been thinking of adding a
passwordstanza toDatabaseRolewhich should mimic what we do for theclientCertificatesection introduced in #10809 (improved with #11312). We should also look at the fields already available in https://external-secrets.io/main/api/generator/password/ and adopt a similar interface. It could look something like this: