<p>As the title says, I'm setting a <code>POSTGRES_PASSWORD</code> and after spinning up the cluster with Skaffold (<code>--port-forward</code> on so I can access the DB with pgAdmin), I can access the database
 with or without the correct password. <code>POSTGRES_DB</code> and <code>POSTGRES_USER</code> work as expected.</p>

<p>I am seeing in the documentation on Docker Hub for Postgres:</p>

<blockquote>
  <p>Note 1: The PostgreSQL image sets up <code>trust</code> authentication locally so you may notice a password is not required when connecting from <code>localhost</code> (inside the same container). However, a password will be required if connecting from a different host/container.</p>
</blockquote>

<p>I think the <code>--port-forward</code> could possibly be the culprit since it is registering as <code>localhost</code>. </p>

<p><strong>Anyway to prevent this behavior?</strong></p>

<p>I guess the concern is someone having access to my laptop and easily being able to connect to the DB.</p>

<p>This is my <code>postgres.yaml</code>:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      component: postgres
  template:
    metadata:
      labels:
        component: postgres
    spec:
      containers:
        - name: postgres
          image:testproject/postgres
          ports:
            - containerPort: 5432
          env: 
            - name: POSTGRES_DB
              value: dev
            - name: POSTGRES_USER
              value: dev
            - name: POSTGRES_PASSWORD
              value: qwerty
          volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql/data
              subPath: postgres
      volumes:
        - name: postgres-storage
          persistentVolumeClaim:
            claimName: postgres-storage
---
apiVersion: v1
kind: Service
metadata:
  name: postgres-cluster-ip-service
spec:
  type: ClusterIP
  selector:
    component: postgres
  ports:
    - port: 5432
      targetPort: 5432
</code></pre>

<p>And the <code>skaffold.yaml</code>:</p>

<pre><code>apiVersion: skaffold/v1beta15
kind: Config
build:
  local:
    push: false
  artifacts:
    - image: testproject/postgres
      docker:
        dockerfile: ./db/Dockerfile.dev
      sync:
        manual:
          - src: "***/*.sql"
            dest: .
    - image: testproject/server
      docker:
        dockerfile: ./server/Dockerfile.dev
      sync:
        manual:
          - src: "***/*.py"
            dest: .
deploy:
  kubectl:
    manifests:
      - k8s/ingress.yaml 
      - k8s/postgres.yaml
      - k8s/server.yaml
</code></pre>

<p>The <code>Dockerfile.dev</code> too:</p>

<pre><code>FROM postgres:11-alpine
EXPOSE 5432
COPY ./db/*.sql /docker-entrypoint-initdb.d/
</code></pre>

<p>Ok, reread the <a href="https://hub.docker.com/_/postgres" rel="nofollow noreferrer"><code>postgres</code> Docker docs</a> and came across this:</p>
<blockquote>
<p><strong>POSTGRES_INITDB_ARGS</strong></p>
<p>This optional environment variable can be used to send arguments to <code>postgres initdb</code>. The value is a space separated string of arguments as <code>postgres initdb</code> would expect them. This is useful for adding functionality like data page checksums: <code>-e POSTGRES_INITDB_ARGS=&quot;--data-checksums&quot;.</code></p>
</blockquote>
<p>That brought me to the <a href="https://www.postgresql.org/docs/9.5/app-initdb.html" rel="nofollow noreferrer"><code>initdb</code> docs</a>:</p>
<blockquote>
<p><strong>--auth=authmethod</strong></p>
<p>This option specifies the authentication method for local users used in pg_hba.conf (host and local lines). Do not use trust unless you trust all local users on your system. trust is the default for ease of installation.</p>
</blockquote>
<p>That brought me to the <a href="https://www.postgresql.org/docs/9.1/auth-methods.html" rel="nofollow noreferrer">Authentication Methods</a> docs:</p>
<blockquote>
<p><strong>19.3.2. Password Authentication</strong></p>
<p>The password-based authentication methods are <code>md5</code> and <code>password</code>. These methods operate similarly except for the way that the password is sent across the connection, namely MD5-hashed and clear-text respectively.</p>
<p>If you are at all concerned about password &quot;sniffing&quot; attacks then <code>md5</code> is preferred. Plain <code>password</code> should always be avoided if possible. However, <code>md5</code> cannot be used with the <code>db_user_namespace</code> feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL).</p>
<p>PostgreSQL database passwords are separate from operating system user passwords. The password for each database user is stored in the <code>pg_authid</code> system catalog. Passwords can be managed with the SQL commands <code>CREATE USER</code> and <code>ALTER ROLE</code>, e.g., <code>CREATE USER foo WITH PASSWORD 'secret'</code>. If no password has been set up for a user, the stored password is null and password authentication will always fail for that user.</p>
</blockquote>
<p>Long story short, I just did this and it takes only the actual password now:</p>
<pre><code>env: 
  ...
  - name: POSTGRES_INITDB_ARGS
    value: &quot;-A md5&quot;
</code></pre>
