1 year ago

#340876

test-img

Sam

Kubernetes connect Psycopg2 to GCP Postgres with SSL

I am stuck trying to connect to a google managed postgres instance from my Kubernetes pod.

My pod and secret yaml looks like

apiVersion: v1
kind: Secret
metadata:
  name: db_secret
stringData:
  CLIENT_KEY: -----BEGIN RSA PRIVATE KEY-----3eFQ==-----END RSA PRIVATE KEY-----
  CLIENT_CERT: -----BEGIN CERTIFICATE-----iiEooYXOze-----END CERTIFICATE-----
  SERVER_CA: -----BEGIN CERTIFICATE-----M9+99XZx4=-----END CERTIFICATE-----

volumeMounts:
                    - mountPath: /certs
                      name: db-ssl-certs
                      readOnly: true
            volumes:
              - name: db-ssl-certs
                secret:
                  secretName: db_secret
                  items:
                    - key: CLIENT_KEY
                      path: client-key.key
                    - key: CLIENT_CERT
                      path: client-cert.crt
                    - key: SERVER_CA
                      path: server-ca.crt
conn = psycopg2.connect(dbname='postgres', user='postgres', host='X.X.X.X', port='5432', sslmode='verify-ca', sslrootcert='server-ca.crt', sslcert='client-cert.crt', sslkey='client-key.key')

When I try to connect with the instance like above, I get an error

Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/local/lib/python3.9/site-packages/psycopg2/__init__.py", line 122, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
psycopg2.OperationalError: could not read root certificate file "server-ca.crt": no certificate or crl found

Any help will be appreciated.

postgresql

ssl

kubernetes

google-cloud-sql

kubernetes-secrets

0 Answers

Your Answer

Accepted video resources