postgres: an external instance accepts plaintext sessions (default pg_hba) #4619

An external postgres accepts plaintext sessions. A client outside the cluster that connects with sslmode=disable gets an unencrypted session, and nothing in the chart can prevent it.

The chart renders no pg_hba rules: there is no pg_hba in packages/apps/postgres/templates/ or in values.yaml at c983b5c. So CloudNativePG's default applies, and it ends with host all all all <method> (pkg/postgres/configuration.go:130 at v1.30.0, the version packages/system/postgres-operator ships). A host rule matches TLS and non-TLS connections alike. ssl is pinned to on by the operator, which means TLS is offered, not required.

The chart's tls.enabled does not change this. It only decides whether the external hostname goes into the certificate. The design for SNI exposure in #2815 assumed that an explicit tls.enabled: false is what makes postgres plaintext, and planned to reject it at admission. That rejection would close nothing, which is why the admission policy for plaintext external databases covers only redis.

What I think the fix looks like: when external: true, render spec.postgresql.pg_hba with hostssl rules for client connections, so the server refuses plaintext instead of leaving the choice to the client. It needs care around the in-cluster clients the chart and platform run (init job, backups, monitoring), which may connect without TLS today. Moving them to TLS, or keeping a host rule scoped to the pod network, has to be decided first. Existing external clients that connect without TLS would break, so this is a breaking change for them.