Prefer clientcert=verify-full to the deprecated clientcert=1 in hba rules

[marszip]

We have updated to Puppet 8.2 and in the release notes it states that PostgreSQL 13 is not supported. The most current version for us is PostgreSQL 15, but we run into a problem with the Puppetforge module for Puppet DB.

The clientcert=1 parameter in the pg_hba.conf is not valid anymore.
This should be clientcert=verify-ca or clientcert=verify-full.

[CLAassistant]

All committers have signed the CLA.

[smortex]

clientcert=verify-full (or verify-ca) was introduced in PostgreSQL 12, so all supported versions of PostgreSQL support this setting. It seems safe to update it.

[h0tw1r3]

clientcert=verify-full (or verify-ca) was introduced in PostgreSQL 12, so all supported versions of PostgreSQL support this setting. It seems safe to update it.

Unless I'm reading this wrong, Postgresql 11 is usually installed by default.

puppetlabs-puppetdb/manifests/params.pp

Line 29 in 0053513

$postgres_version = '11'

[smortex]

clientcert=verify-full (or verify-ca) was introduced in PostgreSQL 12, so all supported versions of PostgreSQL support this setting. It seems safe to update it.

Unless I'm reading this wrong, Postgresql 11 is usually installed by default.

puppetlabs-puppetdb/manifests/params.pp

Line 29 in 0053513

$postgres_version = '11'

This should probably be changed. These versions have reached EOL a long time ago.

As far as I am concerned, I set manage_dbserver => false in my control-repo's puppetdb profile. Managing the server from this module is probably a smell.

[h0tw1r3]

closing in favor of #380