Bump Prole-DB image version to 17.7-059, enable at-rest encryption, and comment out Kerberos and pg_prolelog configurations. Update kdc and admin_server IPs in Kerberos config.

'Add CNPG build/init test and skip tiger geocoder' -m 'Test script usage: scripts/test-cnpg-prole-db.sh' -m 'Env overrides: CNPG_TEST_NAMESPACE, CNPG_CLUSTER_NAME, CNPG_MANIFEST_URL, CNPG_VERSION, IMAGE_LOAD (kind|minikube|k3d), IMAGE_LOAD_CMD, CNPG_INSTANCES'

install.py

@@ -822,7 +822,7 @@ class ProleInstaller:
         self.kerberos_password = tk.StringVar()
         self.kerberos_kdc = tk.StringVar()
         self.supabase_enabled = tk.BooleanVar(value=False)
-        self.at_rest_encryption_enabled = tk.BooleanVar(value=False)
+        self.at_rest_encryption_enabled = tk.BooleanVar(value=True)
         self.ansible_topology = {}
         self.ansible_topology_summary = ''
         try:
@@ -7540,7 +7540,7 @@ class ProleSilentInstaller:
         inputs['init_cluster.cluster_env'] = 'dev'
         inputs['init_cluster.supabase_enabled'] = _bool_str(False)
         inputs['init_cluster.kerberos_enabled'] = _bool_str(False)
-        inputs['init_cluster.at_rest_encryption_enabled'] = _bool_str(False)
+        inputs['init_cluster.at_rest_encryption_enabled'] = _bool_str(True)
         inputs['init_cluster.start_cluster'] = _bool_str(DEFAULT_ACTION_FLAGS.get('init_cluster.start_cluster', True))
 
         # Kerberos config

k8s/openbao/kerberos-configmap.yaml

@@ -12,8 +12,8 @@ data:
 
     [realms]
       PROLE.ORG = {
-        kdc = kdc.prole.org
-        admin_server = kdc.prole.org
+        kdc = 10.0.0.3
+        admin_server = 10.0.0.3
       }
 
     [domain_realm]

k8s/prole/prole-db-recovery.yaml.tpl

@@ -5,7 +5,7 @@ metadata:
   name: prole-db
 spec:
   instances: 3
-  imageName: prole-db:17.7-053
+  imageName: prole-db:17.7-059
   postgresUID: 100
   postgresGID: 101
   maxSyncReplicas: 1
@@ -25,7 +25,7 @@ spec:
       - host prole prole-db all scram-sha-256
       - host all all all scram-sha-256
       - hostssl prole prole-db all scram-sha-256
-      - host all all all gss include_realm=1 krb_realm=EXAMPLE.COM
+      # - host all all all gss include_realm=1 krb_realm=EXAMPLE.COM
 
   bootstrap:
     recovery:

prole-db/.version

@@ -1 +1 @@
-53
+59

prole-db/Dockerfile

@@ -74,12 +74,12 @@ RUN set -eux; \
 
 # Copy and install pg_prolelog from local .deb package
 ARG TARGETARCH
-COPY pg_prolelog/percona-postgresql-17-pg-prolelog_1.0-1_${TARGETARCH:-amd64}.deb /tmp/pg_prolelog.deb
-RUN set -eux; \
-  apt-get update; \
-  apt-get install -y --no-install-recommends /tmp/pg_prolelog.deb; \
-  rm -f /tmp/pg_prolelog.deb; \
-  rm -rf /var/lib/apt/lists/*
+# COPY pg_prolelog/percona-postgresql-17-pg-prolelog_1.0-1_${TARGETARCH:-amd64}.deb /tmp/pg_prolelog.deb
+# RUN set -eux; \
+#   apt-get update; \
+#   apt-get install -y --no-install-recommends /tmp/pg_prolelog.deb; \
+#   rm -f /tmp/pg_prolelog.deb; \
+#   rm -rf /var/lib/apt/lists/*
 
 # Install PostgreSQL extensions
 RUN set -eux; \
@@ -114,7 +114,7 @@ RUN set -eux; \
   echo "    CREATE EXTENSION IF NOT EXISTS tds_fdw;" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
   echo "    CREATE EXTENSION IF NOT EXISTS postgis;" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
   echo "    CREATE EXTENSION IF NOT EXISTS postgis_topology;" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
-  echo "    CREATE EXTENSION IF NOT EXISTS pg_prolelog;" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
+#  echo "    CREATE EXTENSION IF NOT EXISTS pg_prolelog;" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
   echo "EOSQL" >> /docker-entrypoint-initdb.d/20_create_extensions.sh; \
   chmod +x /docker-entrypoint-initdb.d/20_create_extensions.sh
 

prole-db/postgresql/pg_hba.conf

@@ -132,4 +132,4 @@ host    replication     all             127.0.0.1/32            scram-sha-256
 host    replication     all             ::1/128                 scram-sha-256
 
 # Kerberos authentication
-host    all             all             all                     gss include_realm=1 krb_realm=EXAMPLE.COM
+# host    all             all             all                     gss include_realm=1 krb_realm=EXAMPLE.COM