[cluster] Support pooler pgbouncer client/server TLS configuration

[tghartland]

cloudnative-pg/cloudnative-pg#8692 added support for custom TLS secrets in the pooler.spec.pgbouncer configuration.

https://cloudnative-pg.io/docs/devel/cloudnative-pg.v1/#pgbouncerspec

serverTLSSecret
serverCASecret

clientTLSSecret
clientCASecret

The cluster chart does not support these fields in its configuration for the pgbouncer config, and doesn't support setting arbitrary fields so these options are unable to be set.

charts/charts/cluster/templates/pooler.yaml

Lines 13 to 30 in 245b6f8

	pgbouncer:
	poolMode: {{ default "session" .poolMode }}
	{{- with .authQuerySecret }}
	authQuerySecret:
	{{- toYaml . | nindent 6 }}
	{{- end }}
	{{- with .authQuery }}
	authQuery:
	{{- toYaml . | nindent 6 }}
	{{- end }}
	{{- with .parameters }}
	parameters:
	{{- toYaml . | nindent 6 }}
	{{- end }}
	{{- with .pg_hba }}
	pg_hba:
	{{- toYaml . | nindent 6 }}
	{{- end }}

[dosubot]

Hi @tghartland! I'm Dosu and I’m helping the charts team.

The CloudNativePG operator supports custom PgBouncer TLS secrets (clientTLSSecret, clientCASecret, serverTLSSecret, serverCASecret) in the Pooler spec, but the Helm chart does not currently expose these fields or allow arbitrary field inclusion for PgBouncer. This means you cannot set these options via the chart—TLS customization for PgBouncer is not possible through Helm at this time. If you need to use custom TLS secrets, you must manage Pooler resources manually outside the chart and follow the manual integration steps described in the documentation (such as creating the cnpg_pooler_pgbouncer role and authentication function) source.

There are no open issues or PRs in the charts repository tracking support for these fields, and related issues (like #771) confirm that users cannot configure PgBouncer TLS secrets via the Helm chart currently.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}