Change the default authentication method to SCRAM-SHA-256

PostgreSQL has stored passwords as SCRAM-SHA-256 since PostgreSQL 14.
PGO has stored passwords as SCRAM-SHA-256 since PostgreSQL 10.

The "spec.authentication.rules" and "spec.config.parameters" fields
allow users to downgrade to MD5 when necessary.

Issue: PGO-2290
See: https://www.postgresql.org/docs/current/auth-password.html

Author: cbandy

internal/controller/postgrescluster/postgres.go

@@ -53,11 +53,11 @@ func (*Reconciler) generatePostgresHBA(spec *v1beta1.PostgresHBARule) *postgres.
 	result.Origin(spec.Connection)
 
 	// The "password" method is not recommended. More likely, the user wants to
-	// use passwords generally. The most compatible method for that is "md5"
-	// which accepts a password in the format in which it is hashed in the database.
+	// use passwords generally. The "scram-sha-256" method is the preferred way
+	// to do that.
 	// - https://www.postgresql.org/docs/current/auth-password.html
 	if spec.Method == "password" {
-		result.Method("md5")
+		result.Method("scram-sha-256")
 	} else {
 		result.Method(spec.Method)
 	}

internal/controller/postgrescluster/postgres_test.go

@@ -59,10 +59,10 @@ func TestGeneratePostgresHBA(t *testing.T) {
 			rule:     `{ connection: hostssl, method: md5, options: { clientcert: verify-ca } }`,
 			expected: `"hostssl" all all all "md5"  "clientcert"="verify-ca"`,
 		},
-		// "password" input should be "md5" output
+		// "password" input should be "scram-sha-256" output
 		{
 			rule:     `{ connection: hostssl, method: password }`,
-			expected: `"hostssl" all all all "md5"`,
+			expected: `"hostssl" all all all "scram-sha-256"`,
 		},
 	} {
 		var rule *v1beta1.PostgresHBARule

internal/postgres/hba.go

@@ -29,11 +29,11 @@ func NewHBAs() HBAs {
 		},
 
 		Default: []*HostBasedAuthentication{
-			// Allow TLS connections to any database using passwords. The "md5"
-			// authentication method automatically verifies passwords encrypted
-			// using either MD5 or SCRAM-SHA-256.
+			// Allow TLS connections to any database using passwords. Passwords are
+			// hashed and stored using SCRAM-SHA-256 by default. Since PostgreSQL 10,
+			// the "scram-sha-256" method is the preferred way to use those passwords.
 			// - https://www.postgresql.org/docs/current/auth-password.html
-			NewHBA().TLS().Method("md5"),
+			NewHBA().TLS().Method("scram-sha-256"),
 		},
 	}
 }

internal/postgres/hba_test.go

@@ -36,7 +36,7 @@ hostssl  "postgres"   "_crunchyrepl"  all   "cert"
 host     all          "_crunchyrepl"  all   "reject"
 	`))
 	assert.Assert(t, matches(hba.Default, `
-hostssl  all  all  all  "md5"
+hostssl  all  all  all  "scram-sha-256"
 	`))
 }