implement postgres support for TLS

common/persistence/sql/sqlplugin/postgres/plugin.go

@@ -21,32 +21,28 @@
 package postgres
 
 import (
-	"errors"
 	"fmt"
 	"net"
+	"net/url"
 	"os"
 	"runtime"
 
 	pt "github.com/uber/cadence/common/persistence/persistence-tests"
 	"github.com/uber/cadence/environment"
-
-	"github.com/iancoleman/strcase"
-	"github.com/jmoiron/sqlx"
-
 	"github.com/uber/cadence/common/persistence/sql"
 	"github.com/uber/cadence/common/persistence/sql/sqlplugin"
 	"github.com/uber/cadence/common/service/config"
+
+	"github.com/iancoleman/strcase"
+	"github.com/jmoiron/sqlx"
 )
 
 const (
 	// PluginName is the name of the plugin
-	PluginName                     = "postgres"
-	dataSourceNamePostgres         = "user=%v host=%v port=%v dbname=%v sslmode=disable %v "
-	dataSourceNamePostgresPassword = "password=%v"
+	PluginName = "postgres"
+	dsnFmt     = "postgres://%s@%s:%s/%s"
 )
 
-var errTLSNotImplemented = errors.New("tls for postgres has not been implemented")
-
 type plugin struct{}
 
 var _ sqlplugin.Plugin = (*plugin)(nil)
@@ -80,7 +76,7 @@ func (d *plugin) CreateAdminDB(cfg *config.SQL) (sqlplugin.AdminDB, error) {
 // SQL database and the object can be used to perform CRUD operations on
 // the tables in the database
 func (d *plugin) createDBConnection(cfg *config.SQL) (*sqlx.DB, error) {
-	err := registerTLSConfig(cfg)
+	sslParams, err := registerTLSConfig(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -90,32 +86,60 @@ func (d *plugin) createDBConnection(cfg *config.SQL) (*sqlx.DB, error) {
 		return nil, fmt.Errorf("invalid connect address, it must be in host:port format, %v, err: %v", cfg.ConnectAddr, err)
 	}
 
+	db, err := sqlx.Connect(PluginName, buildDSN(cfg, host, port, sslParams))
+	if err != nil {
+		return nil, err
+	}
+	if cfg.MaxConns > 0 {
+		db.SetMaxOpenConns(cfg.MaxConns)
+	}
+	if cfg.MaxIdleConns > 0 {
+		db.SetMaxIdleConns(cfg.MaxIdleConns)
+	}
+	if cfg.MaxConnLifetime > 0 {
+		db.SetConnMaxLifetime(cfg.MaxConnLifetime)
+	}
+
+	// Maps struct names in CamelCase to snake without need for db struct tags.
+	db.MapperFunc(strcase.ToSnake)
+	return db, nil
+}
+
+func buildDSN(cfg *config.SQL, host string, port string, sslParams url.Values) string {
 	dbName := cfg.DatabaseName
 	//NOTE: postgres doesn't allow to connect with empty dbName, the admin dbName is "postgres"
 	if dbName == "" {
 		dbName = "postgres"
 	}
-	password := ""
-	if cfg.Password != "" {
-		password = fmt.Sprintf(dataSourceNamePostgresPassword, cfg.Password)
-	}
-	db, err := sqlx.Connect(PluginName, fmt.Sprintf(dataSourceNamePostgres, cfg.User, host, port, dbName, password))
 
-	if err != nil {
-		return nil, err
+	credentialString := generateCredentialString(cfg.User, cfg.Password)
+	dsn := fmt.Sprintf(dsnFmt, credentialString, host, port, dbName)
+	if attrs := sslParams.Encode(); attrs != "" {
+		dsn += "?" + attrs
 	}
+	return dsn
+}
 
-	// Maps struct names in CamelCase to snake without need for db struct tags.
-	db.MapperFunc(strcase.ToSnake)
-	return db, nil
+func generateCredentialString(user string, password string) string {
+	userPass := user
+	if password != "" {
+		userPass += ":" + password
+	}
+	return userPass
 }
 
-// TODO: implement postgres specific support for TLS
-func registerTLSConfig(cfg *config.SQL) error {
-	if cfg.TLS == nil || !cfg.TLS.Enabled {
-		return nil
+func registerTLSConfig(cfg *config.SQL) (sslParams url.Values, err error) {
+	sslParams = url.Values{}
+	if cfg.TLS != nil && cfg.TLS.Enabled {
+		sslParams.Set("ssl", "true")
+		sslParams.Set("sslmode", "require")
+		sslParams.Set("sslrootcert", cfg.TLS.CaFile)
+		sslParams.Set("sslkey", cfg.TLS.KeyFile)
+		sslParams.Set("sslcert", cfg.TLS.CertFile)
+	} else {
+		sslParams.Set("sslmode", "disable")
 	}
-	return errTLSNotImplemented
+	return
 }
 
 const (

common/persistence/sql/sqlplugin/postgres/postgres_server_test.go

@@ -28,6 +28,38 @@ import (
 	pt "github.com/uber/cadence/common/persistence/persistence-tests"
 )
 
+
+const (
+	testSchemaDir = "schema/postgres"
+)
+
+func getTestClusterOption() *pt.TestBaseOptions {
+	testUser := "postgres"
+	testPassword := "cadence"
+
+	if runtime.GOOS == "darwin" {
+		testUser = os.Getenv("USER")
+		testPassword = ""
+	}
+
+	if os.Getenv("POSTGRES_USER") != "" {
+		testUser = os.Getenv("POSTGRES_USER")
+	}
+
+	if os.Getenv("POSTGRES_PASSWORD") != "" {
+		testPassword = os.Getenv("POSTGRES_PASSWORD")
+	}
+
+	return &pt.TestBaseOptions{
+		SQLDBPluginName: PluginName,
+		DBUsername:      testUser,
+		DBPassword:      testPassword,
+		DBHost:          environment.GetPostgresAddress(),
+		DBPort:          environment.GetPostgresPort(),
+		SchemaDir:       testSchemaDir,
+	}
+}
+
 func TestSQLHistoryV2PersistenceSuite(t *testing.T) {
 	s := new(pt.HistoryV2PersistenceSuite)
 	s.TestBase = pt.NewTestBaseWithSQL(GetTestClusterOption())

go.mod

@@ -67,6 +67,7 @@ require (
 	go.uber.org/yarpc v1.42.0
 	go.uber.org/zap v1.12.0
 	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+	golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c // indirect
 	golang.org/x/time v0.0.0-20190308202827-9d24e82272b4
 	golang.org/x/tools v0.0.0-20200917221617-d56e4e40bc9d
 	gonum.org/v1/gonum v0.7.0