<p>I'm trying to make my app connect to my PostgreSQL instance through an encrypted and secure connection.</p>
<p>I've configured my server certificate and generated the client cert and key files.</p>
<p>The following command connects without problems:</p>
<pre class="lang-sh prettyprint-override"><code>psql &quot;sslmode=verify-ca sslrootcert=server-ca.pem \
  sslcert=client-cert.pem sslkey=client-key.pem \
  hostaddr=&lt;instance_ip&gt; \
  port=5432 \
  user=db dbname=dbname&quot;
</code></pre>
<p>Unfortunately, I couldn't find a way to pass the client key as value, I can only pass the file path. Even using the default environment variables from psql, this is not possible: <a href="https://www.postgresql.org/docs/current/libpq-envars.html" rel="nofollow noreferrer">https://www.postgresql.org/docs/current/libpq-envars.html</a></p>
<p>Golang follows the same specifications as lib-pq and there is no way to pass the cert and key values: <a href="https://pkg.go.dev/github.com/lib/pq?tab=doc#hdr-Connection_String_Parameters" rel="nofollow noreferrer">https://pkg.go.dev/github.com/lib/pq?tab=doc#hdr-Connection_String_Parameters</a>.</p>
<p>I want to store the client cert and key in environment variables for security reasons, I don't want to store sensitive files in github/gitlab.</p>

<p>Just set the values in your environment and you can get them in a init function.</p>
<pre><code>func init() {
   var := os.Getenv(&quot;SOME_KEY&quot;)
}
</code></pre>
<p>When you want to set these with K8s you would just do this in a yaml file.</p>
<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: my-secret
data:
  SOME_KEY: the-value-of-the-key
</code></pre>
<p>Then to inject into the environment do.</p>
<pre><code>envFrom:
  - secretRef:
    name: my-secret
</code></pre>
<p>Now when your init function runs it will we able to see SOME_KEY.</p>
<p>If you want to pass a secret as a file you do something like this.</p>
<pre><code>kubectl create secret generic my-secret-files --from-file=my-secret-file-1.stuff --from-file=my-secret-file-2.stuff
</code></pre>
<p>Then in your deployment.</p>
<pre><code>volumes:
  - name: my-secret-files
    secret:
      secretName: my-secret-files
</code></pre>
<p>Also in your deployment under you container.</p>
<pre><code>volumeMounts:
  - name: my-secret-files
    mountPath: /config/
</code></pre>
<p>Now your init would be able to see.</p>
<pre><code>/config/my-secret-file-1.stuff
/config/my-secret-file-2.stuff
</code></pre>
