From 3d97c71f753928eae54d4dbefb576937b7c14f80 Mon Sep 17 00:00:00 2001
From: Mitch Murphy <mitchell.murphy@defenseunicorns.com>
Date: Fri, 5 Jun 2026 14:51:40 -0400
Subject: [PATCH] docs(pooler): document and expose generate-config parameters

---
 .../crds/operatorconfigurations.yaml          | 17 +++++++++++++
 charts/postgres-operator/values.yaml          |  9 +++++++
 docs/reference/operator_parameters.md         | 24 +++++++++++++++++++
 manifests/operatorconfiguration.crd.yaml      | 17 +++++++++++++
 ...gresql-operator-default-configuration.yaml |  6 +++++
 5 files changed, 73 insertions(+)

diff --git a/charts/postgres-operator/crds/operatorconfigurations.yaml b/charts/postgres-operator/crds/operatorconfigurations.yaml
index 961b5b655..13c3d7d04 100644
--- a/charts/postgres-operator/crds/operatorconfigurations.yaml
+++ b/charts/postgres-operator/crds/operatorconfigurations.yaml
@@ -851,6 +851,23 @@ spec:
                   connection_pooler_default_memory_request:
                     type: string
                     pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
+                  connection_pooler_generate_config:
+                    type: boolean
+                    default: false
+                  connection_pooler_command:
+                    type: array
+                    items:
+                      type: string
+                  connection_pooler_args:
+                    type: array
+                    items:
+                      type: string
+                  connection_pooler_auth_type:
+                    type: string
+                    default: "scram-sha-256"
+                  connection_pooler_config_path:
+                    type: string
+                    default: "/etc/pgbouncer/pgbouncer.ini"
               patroni:
                 type: object
                 properties:
diff --git a/charts/postgres-operator/values.yaml b/charts/postgres-operator/values.yaml
index 82e9ac342..687c55bad 100644
--- a/charts/postgres-operator/values.yaml
+++ b/charts/postgres-operator/values.yaml
@@ -471,6 +471,15 @@ configConnectionPooler:
   connection_pooler_default_memory_request: 100Mi
   connection_pooler_default_cpu_limit: "1"
   connection_pooler_default_memory_limit: 100Mi
+  # whether the operator should generate the pgbouncer.ini config map and
+  # override the pooler container command/args (needed for images without an
+  # entrypoint that renders the config, e.g. the Chainguard FIPS pgbouncer image)
+  connection_pooler_generate_config: false
+  # connection_pooler_command: []
+  connection_pooler_args:
+    - "/etc/pgbouncer/pgbouncer.ini"
+  connection_pooler_auth_type: "scram-sha-256"
+  connection_pooler_config_path: "/etc/pgbouncer/pgbouncer.ini"
 
 configPatroni:
   # enable Patroni DCS failsafe_mode feature
diff --git a/docs/reference/operator_parameters.md b/docs/reference/operator_parameters.md
index 332742a16..4e9b008f9 100644
--- a/docs/reference/operator_parameters.md
+++ b/docs/reference/operator_parameters.md
@@ -1094,3 +1094,27 @@ operator being able to provide some reasonable defaults.
   **connection_pooler_default_cpu_limit**
   **connection_pooler_default_memory_limit**
   Default resource configuration for connection pooler deployment.
+
+* **connection_pooler_generate_config**
+  when `true`, the operator renders a `pgbouncer.ini` into an operator-owned
+  ConfigMap, mounts it into the pooler pod, and overrides the container
+  command/args. Use for pgbouncer images that do not ship an entrypoint that
+  renders the config (e.g. FIPS/distroless images). The default `false`
+  preserves the stock behavior of relying on the image entrypoint.
+
+* **connection_pooler_command**
+  container `command` override applied only when `connection_pooler_generate_config`
+  is enabled. Empty (default) keeps the image entrypoint.
+
+* **connection_pooler_args**
+  container `args` applied only when `connection_pooler_generate_config` is
+  enabled. The default `["/etc/pgbouncer/pgbouncer.ini"]` points pgbouncer at the
+  mounted config.
+
+* **connection_pooler_auth_type**
+  `auth_type` written into the generated `pgbouncer.ini`. The default
+  `scram-sha-256`.
+
+* **connection_pooler_config_path**
+  mount path of the generated `pgbouncer.ini` inside the pooler container. The
+  default `/etc/pgbouncer/pgbouncer.ini`.
diff --git a/manifests/operatorconfiguration.crd.yaml b/manifests/operatorconfiguration.crd.yaml
index 81bcd4381..e46c63cc9 100644
--- a/manifests/operatorconfiguration.crd.yaml
+++ b/manifests/operatorconfiguration.crd.yaml
@@ -849,6 +849,23 @@ spec:
                   connection_pooler_default_memory_request:
                     type: string
                     pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
+                  connection_pooler_generate_config:
+                    type: boolean
+                    default: false
+                  connection_pooler_command:
+                    type: array
+                    items:
+                      type: string
+                  connection_pooler_args:
+                    type: array
+                    items:
+                      type: string
+                  connection_pooler_auth_type:
+                    type: string
+                    default: "scram-sha-256"
+                  connection_pooler_config_path:
+                    type: string
+                    default: "/etc/pgbouncer/pgbouncer.ini"
               patroni:
                 type: object
                 properties:
diff --git a/manifests/postgresql-operator-default-configuration.yaml b/manifests/postgresql-operator-default-configuration.yaml
index 88af48b66..1e74e665d 100644
--- a/manifests/postgresql-operator-default-configuration.yaml
+++ b/manifests/postgresql-operator-default-configuration.yaml
@@ -234,5 +234,11 @@ configuration:
     connection_pooler_number_of_instances: 2
     # connection_pooler_schema: "pooler"
     # connection_pooler_user: "pooler"
+    connection_pooler_generate_config: false
+    # connection_pooler_command: []
+    # connection_pooler_args:
+    #   - "/etc/pgbouncer/pgbouncer.ini"
+    connection_pooler_auth_type: "scram-sha-256"
+    connection_pooler_config_path: "/etc/pgbouncer/pgbouncer.ini"
   patroni:
     enable_patroni_failsafe_mode: false