Add audit database user for audit purposes

This commit adds an audit user to the postgresql database which
will have only SELECT privileges on the postgresql database tables.
This is accomplished by setting up audit user creation parameters
in the Patroni bootstrap environment settings, according to (1).

(1) https://patroni.readthedocs.io/en/latest/ENVIRONMENT.html

Change-Id: Idf1cd90b5d093f12fa4a3c5c794d4b5bbc6c8831

postgresql/templates/secret-audit.yaml

@@ -0,0 +1,26 @@
+{{/*
+Copyright 2020 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+{{- if .Values.manifests.secret_audit }}
+{{- $envAll := . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secrets.postgresql.audit }}
+type: Opaque
+data:
+  AUDIT_PASSWORD: {{ .Values.endpoints.postgresql.auth.audit.password | b64enc }}
+{{- end }}

postgresql/templates/statefulset.yaml

@@ -332,6 +332,18 @@ spec:
               value: $(PATRONI_SUPERUSER_PASSWORD)
             - name: PATRONI_{{ .Values.endpoints.postgresql.auth.admin.username }}_OPTIONS
               value: 'createrole,createdb'
+{{- if .Values.manifests.secret_audit }}
+            - name: AUDIT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.postgresql.audit }}
+                  key: AUDIT_PASSWORD
+            # Adding the audit user with no options just adds the user without
+            # any GRANTs. This means the user gets to do only what default
+            # PUBLIC permissions allow, which is only to SELECT from tables.
+            - name: PATRONI_{{ .Values.endpoints.postgresql.auth.audit.username }}_PASSWORD
+              value: $(AUDIT_PASSWORD)
+{{- end }}
             - name: PGSSLROOTCERT
               value: {{ .Values.secrets.pki.client_cert_path }}/ca.crt
             - name: PGSSLCERT

postgresql/values.yaml

@@ -378,6 +378,7 @@ secrets:
     replica: postgresql-replication-pki
     server: postgresql-server-pki
     exporter: postgresql-exporter
+    audit: postgresql-audit
 
 endpoints:
   cluster_domain_suffix: cluster.local
@@ -403,6 +404,9 @@ endpoints:
       exporter:
         username: psql_exporter
         password: psql_exp_pass
+      audit:
+        username: audit
+        password: password
     hosts:
       default: postgresql
     host_fqdn_override:
@@ -445,6 +449,7 @@ manifests:
   secret_replica: true
   secret_server: true
   secret_etc: true
+  secret_audit: true
   service: true
   statefulset: true
   cron_job_postgresql_backup: false