Postgres workload credentials ¶

When an Application or Job uses a Postgres database, Postgres provides connection settings as environment variables. Workloads authenticate with TLS client certificates; no password is provided.

Environment variables ¶

Each credential set contains these variables:

Variable	Value
`PGHOST`	Database hostname
`PGPORT`	Database port
`PGDATABASE`	Database name
`PGUSER`	Database username
`PGSSLMODE`	TLS verification mode
`PGSSLCERT`	Path to the workload's client certificate
`PGSSLKEY`	Path to the workload's PEM client key
`PGSSLROOTCERT`	Path to the CA certificate
`PGJDBCURL`	JDBC URL for pgJDBC, including username and TLS settings

PGJDBCURL uses sslmode=verify-full and includes paths to the CA certificate, client certificate and PKCS#8 DER key.

Certificate and key files ¶

Each credential set has files under /var/run/secrets/nais.io/postgres/<postgres>/<credential>/, where <credential> is admin, read or readwrite:

File	Format and use
`tls.crt`	PEM client certificate
`tls.key`	PEM private key, referenced by `PGSSLKEY`
`tls.pk8`	The same private key in unencrypted PKCS#8 DER format, referenced by `PGJDBCURL`

The shared CA certificate is at /var/run/secrets/nais.io/postgres/<postgres>/ca.crt.

Roles and prefixes ¶

The role controls which credential sets the workload receives:

Role	Credential prefixes	Intended use
`admin`	Unprefixed and `READWRITE_`	Schema migrations and ordinary application traffic
`readwrite`	`READWRITE_`	Ordinary application traffic
`read`	`READ_`	Read-only application traffic

admin is the default role.

For example, a readwrite credential has variables such as READWRITE_PGHOST and READWRITE_PGJDBCURL.

When you set envPrefix, it is prepended before the role prefix. With envPrefix: MYDB_, a readwrite credential has variables such as MYDB_READWRITE_PGJDBCURL.

When envPrefix is not set, PostgreSQL clients that support standard PG* environment variables work out of the box with the unprefixed admin credentials. Use the READWRITE_ credentials for the long-running application process when the workload also runs schema migrations.