Database Access with CloudNativePG

[benni-as]

Hi,

I would like to enable database access via Teleport with the CloudNativePG Kubernetes Operator (CNPG).

As far as I understand, the CNPG basically supports two modes for handling certificates. a) Either it manages all certificates itself or b) an external CA must provide certificates for all components.

The most promising approach seems to me to be the one according to a). I would then have to extend the clientCASecret from the CNPG with the client-db.ca from Teleport so that the teleport agent can log into the postgres cluster. This concept was also mentioned in another discussion. Unfortunately, I have not yet found a simple solution to automate this. This is a problem because the client certs are regularly rotated by the CNPG and this may then break the replication of the cluster.

Are there already sustainable solutions for integrating Teleport with the CNPG Operator?