Add ssl options to postgres pillar

changelog/67720.added.md

@@ -0,0 +1 @@
+Added ssl options to postgres pillar.

requirements/static/ci/common.txt

@@ -69,3 +69,4 @@ genshi>=0.7.3
 cheetah3>=3.2.2
 mako
 wempy
+psycopg2-binary; sys_platform != 'win32'

requirements/static/ci/py3.10/cloud.lock

@@ -479,6 +479,10 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.10/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.10/linux.lock

requirements/static/ci/py3.10/darwin.lock

@@ -357,6 +357,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.10/freebsd.lock

@@ -386,6 +386,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.10/lint.lock

@@ -501,6 +501,10 @@ psutil==7.2.2
     #   -c requirements/static/ci/py3.10/linux.lock
     #   -c requirements/static/pkg/py3.10/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.10/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.10/linux.lock

requirements/static/ci/py3.10/linux.lock

@@ -386,6 +386,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.11/cloud.lock

@@ -470,6 +470,10 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.11/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.11/linux.lock

requirements/static/ci/py3.11/darwin.lock

@@ -351,6 +351,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.11/freebsd.lock

@@ -380,6 +380,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.11/lint.lock

@@ -496,6 +496,10 @@ psutil==7.2.2
     #   -c requirements/static/ci/py3.11/linux.lock
     #   -c requirements/static/pkg/py3.11/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.11/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.11/linux.lock

requirements/static/ci/py3.11/linux.lock

@@ -379,6 +379,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.12/cloud.lock

@@ -465,6 +465,10 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.12/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.12/linux.lock

requirements/static/ci/py3.12/darwin.lock

@@ -347,6 +347,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.12/freebsd.lock

@@ -376,6 +376,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.12/lint.lock

@@ -487,6 +487,10 @@ psutil==7.2.2
     #   -c requirements/static/ci/py3.12/linux.lock
     #   -c requirements/static/pkg/py3.12/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.12/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.12/linux.lock

requirements/static/ci/py3.12/linux.lock

@@ -373,6 +373,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.13/cloud.lock

@@ -466,6 +466,10 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.13/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.13/linux.lock

requirements/static/ci/py3.13/darwin.lock

@@ -348,6 +348,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.13/freebsd.lock

@@ -377,6 +377,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.13/lint.lock

@@ -487,6 +487,10 @@ psutil==7.2.2
     #   -c requirements/static/ci/py3.13/linux.lock
     #   -c requirements/static/pkg/py3.13/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.13/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.13/linux.lock

requirements/static/ci/py3.13/linux.lock

@@ -374,6 +374,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.14/cloud.lock

@@ -466,6 +466,10 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.14/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.14/linux.lock

requirements/static/ci/py3.14/darwin.lock

@@ -348,6 +348,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.14/freebsd.lock

@@ -365,6 +365,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.14/lint.lock

@@ -487,6 +487,10 @@ psutil==7.2.2
     #   -c requirements/static/ci/py3.14/linux.lock
     #   -c requirements/static/pkg/py3.14/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.14/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.14/linux.lock

requirements/static/ci/py3.14/linux.lock

@@ -374,6 +374,8 @@ psutil==7.2.2
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.9/cloud.lock

@@ -525,6 +525,10 @@ psutil==5.9.8
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.9/linux.lock
+    #   -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via
     #   -c requirements/static/ci/py3.9/linux.lock

requirements/static/ci/py3.9/darwin.lock

@@ -389,6 +389,8 @@ psutil==5.9.8
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.9/freebsd.lock

@@ -469,6 +469,8 @@ psutil==7.2.2 ; python_full_version >= '3.10'
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12 ; sys_platform != 'win32'
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

requirements/static/ci/py3.9/lint.lock

@@ -551,6 +551,10 @@ psutil==5.9.8
     #   -c requirements/static/ci/py3.9/linux.lock
     #   -c requirements/static/pkg/py3.9/linux.lock
     #   -r requirements/base.txt
+psycopg2-binary==2.9.12
+    # via
+    #   -c requirements/static/ci/py3.9/linux.lock
+    #   -r requirements/static/ci/common.txt
 pyasn1==0.6.3
     # via
     #   -c requirements/static/ci/py3.9/linux.lock

requirements/static/ci/py3.9/linux.lock

@@ -419,6 +419,8 @@ psutil==5.9.8
     #   pytest-salt-factories
     #   pytest-shell-utilities
     #   pytest-system-statistics
+psycopg2-binary==2.9.12
+    # via -r requirements/static/ci/common.txt
 py-cpuinfo==9.0.0
     # via pytest-benchmark
 pyasn1==0.6.3

salt/pillar/postgres.py

@@ -69,6 +69,12 @@ def _get_options(self):
             "pass": "salt",
             "db": "salt",
             "port": 5432,
+            "sslmode": "prefer",
+            "sslcert": None,
+            "sslkey": None,
+            "sslrootcert": None,
+            "sslcrl": None,
+            "kwargs": {},
         }
         _options = {}
         _opts = __opts__.get("postgres", {})
@@ -92,6 +98,12 @@ def _get_cursor(self):
             password=_options["pass"],
             dbname=_options["db"],
             port=_options["port"],
+            sslmode=_options["sslmode"],
+            sslcert=_options["sslcert"],
+            sslkey=_options["sslkey"],
+            sslrootcert=_options["sslrootcert"],
+            sslcrl=_options["sslcrl"],
+            **_options["kwargs"],
         )
         cursor = conn.cursor()
         try:

tests/pytests/unit/pillar/test_postgres.py

@@ -0,0 +1,67 @@
+import pytest
+
+import salt.pillar.postgres as postgres
+from tests.support.mock import MagicMock, patch
+
+try:
+    import psycopg2  # pylint: disable=unused-import
+
+    HAS_POSTGRES = True
+except ImportError:
+    HAS_POSTGRES = False
+pytestmark = [
+    pytest.mark.skipif(not HAS_POSTGRES, reason="Package psycopg2 is not installed."),
+]
+
+
+def test_should_pass_ssl_args():
+    postgres_opts = {
+        "postgres": {
+            "host": "postgres",
+            "sslmode": "verify-ca",
+            "sslcert": "/path/to/sslcert",
+            "sslkey": "/path/to/sslkey",
+            "sslrootcert": "/path/to/sslrootcert",
+            "sslcrl": "/path/to/sslcrl",
+            "kwargs": {"application_name": "salt"},
+        }
+    }
+    with (
+        patch("salt.pillar.postgres.__opts__", postgres_opts, create=True),
+        patch("psycopg2.connect", MagicMock()) as connect_mock,
+    ):
+        postgres.ext_pillar("test", {})
+    connect_mock.assert_called_with(
+        host="postgres",
+        user="salt",
+        password="salt",
+        dbname="salt",
+        port=5432,
+        sslmode="verify-ca",
+        sslcert="/path/to/sslcert",
+        sslkey="/path/to/sslkey",
+        sslrootcert="/path/to/sslrootcert",
+        sslcrl="/path/to/sslcrl",
+        application_name="salt",
+    )
+
+
+def test_should_pass_default_args():
+    postgres_opts = {}
+    with (
+        patch("salt.pillar.postgres.__opts__", postgres_opts, create=True),
+        patch("psycopg2.connect", MagicMock()) as connect_mock,
+    ):
+        postgres.ext_pillar("test", {})
+    connect_mock.assert_called_with(
+        host="localhost",
+        user="salt",
+        password="salt",
+        dbname="salt",
+        port=5432,
+        sslmode="prefer",
+        sslcert=None,
+        sslkey=None,
+        sslrootcert=None,
+        sslcrl=None,
+    )