Add toggle to allow namespaced secrets

pkg/cluster/cluster.go

@@ -41,7 +41,7 @@ import (
 var (
 	alphaNumericRegexp    = regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9]*$")
 	databaseNameRegexp    = regexp.MustCompile("^[a-zA-Z_][a-zA-Z0-9_]*$")
-	userRegexp            = regexp.MustCompile(`^[a-z0-9]+\.?[-_a-z0-9]+[a-z0-9]$`)
+	userRegexp            = regexp.MustCompile(`^[a-z0-9]([-_a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-_a-z0-9]*[a-z0-9])?)*$`)
 	patroniObjectSuffixes = []string{"config", "failover", "sync"}
 )
 
@@ -1111,10 +1111,13 @@ func (c *Cluster) initRobotUsers() error {
 		}
 		namespace := c.Namespace
 
-		//more than one dot in the username is reported invalid by regexp
-		if strings.Contains(username, ".") {
-			splits := strings.Split(username, ".")
-			namespace = splits[0]
+		//if namespaced secrets are allowed
+		if c.Postgresql.Spec.EnableNamespacedSecret != nil &&
+			*c.Postgresql.Spec.EnableNamespacedSecret {
+			if strings.Contains(username, ".") {
+				splits := strings.Split(username, ".")
+				namespace = splits[0]
+			}
 		}
 
 		flags, err := normalizeUserFlags(userFlags)

pkg/cluster/cluster_test.go

@@ -870,6 +870,7 @@ func TestCrossNamespacedSecrets(t *testing.T) {
 			Volume: acidv1.Volume{
 				Size: "1Gi",
 			},
+			EnableNamespacedSecret: boolToPointer(true),
 			Users: map[string]acidv1.UserFlags{
 				"appspace.db_user": {},
 				"db_user":          {},
@@ -920,11 +921,16 @@ func TestCrossNamespacedSecrets(t *testing.T) {
 func TestValidUsernames(t *testing.T) {
 	testName := "test username validity"
 
-	invalidUsernames := []string{"_", ".", ".user", "appspace.", "appspace.user.extra", "user_", "_user", "-user", "user-", ",", "-", ",user", "user,", "namespace,user"}
-
+	invalidUsernames := []string{"_", ".", ".user", "appspace.", "user_", "_user", "-user", "user-", ",", "-", ",user", "user,", "namespace,user"}
+	validUsernames := []string{"user", "appspace.user", "appspace.dot.user", "user_name", "app_space.user_name"}
 	for _, username := range invalidUsernames {
 		if isValidUsername(username) {
 			t.Errorf("%s Invalid username is allowed: %s", testName, username)
 		}
 	}
+	for _, username := range validUsernames {
+		if !isValidUsername(username) {
+			t.Errorf("%s Valid username is not allowed: %s", testName, username)
+		}
+	}
 }