<p>Can please somebody help me? This is my first post here, and I am really exited to start posting here and helping people but I need help first.</p>

<p>I am deploying my own Postgres database on Minikube. For db, password and username I am using secrets.</p>

<p>Data is encoded with base64</p>

<ol>
<li>POSTGRES_USER = website_user</li>
<li>POSTGRES_DB = website</li>
<li>POSTGRES_PASSWORD = pass</li>
</ol>

<p>I also exec into container to see if I could see these envs and they were there.</p>

<p>The problem is when I try to enter into postgres with psql. I checked minikube ip and typed correct password(pass) after this command:</p>

<pre><code>pqsl -h 192.168.99.100 -U website_user -p 31315 website
</code></pre>

<p>Error</p>

<blockquote>
  <p>Password for user website_user:<br>
  psql: FATAL:  password authentication failed for user "website_user"</p>
</blockquote>

<p>Also if I exec into my pod: </p>

<pre><code>kubectl exec -it postgres-deployment-744fcdd5f5-7f7vx bash
</code></pre>

<p>And try to enter into postgres I get:</p>

<pre><code>psql -h $(hostname -i) -U website_user -p 5432 website
</code></pre>

<p>Error:</p>

<blockquote>
  <p>Password for user website_user:<br>
  psql: FATAL:  password authentication failed for user "website_user"</p>
</blockquote>

<p>I am lacking something here.I tried also <code>ps aux</code> in container, and everything seems to be find postgres processes are running</p>

<pre><code>kubectl get all
</code></pre>

<p>Output:</p>

<pre><code>NAME                                       READY   STATUS    RESTARTS   AGE
pod/postgres-deployment-744fcdd5f5-7f7vx   1/1     Running   0          18m

NAME                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
service/kubernetes         ClusterIP   10.96.0.1        &lt;none&gt;        443/TCP          19m
service/postgres-service   NodePort    10.109.235.114   &lt;none&gt;        5432:31315/TCP   18m

NAME                                  READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/postgres-deployment   1/1     1            1           18m

NAME                                             DESIRED   CURRENT   READY   AGE
replicaset.apps/postgres-deployment-744fcdd5f5   1         1         1       18m

# Secret store
apiVersion: v1
kind: Secret
metadata:
  name: postgres-credentials
type: Opaque
data:
  POSTGRES_USER: d2Vic2l0ZV91c2VyCg==
  POSTGRES_PASSWORD: cGFzcwo=
  POSTGRES_DB: d2Vic2l0ZQo=


---
# Persistent Volume
apiVersion: v1
kind: PersistentVolume
metadata:
  name: postgres-pv
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 2Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: /data/postgres-pv


---
# Persistent Volume Claim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
  labels:
    type: local
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  volumeName: postgres-pv

---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment
spec:
  selector:
    matchLabels:
      app: postgres-container
  template:
    metadata:
      labels:
        app: postgres-container
    spec:
      containers:
        - name: postgres-container
          image: postgres:9.6.6
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: POSTGRES_USER

            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: POSTGRES_DB

            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-credentials
                  key: POSTGRES_PASSWORD

          ports:
            - containerPort: 5432
          volumeMounts:
            - mountPath: /var/lib/postgresql/data
              name: postgres-volume-mount
      volumes:
        - name: postgres-volume-mount
          persistentVolumeClaim:
            claimName: postgres-pvc

---
apiVersion: v1
kind: Service
metadata:
  name: postgres-service
spec:
  selector:
    app: postgres-container
  ports:
    - port: 5432
      protocol: TCP
      targetPort: 5432
  type: NodePort
</code></pre>

<p><strong>You created all your values with:</strong></p>

<ul>
<li><code>$ echo "value" | base64</code></li>
<li><strong>which instead you should use: <code>$ echo -n "value" | base64</code></strong></li>
</ul>

<p>Following official man page of <code>echo</code>: </p>

<blockquote>
  <h2>Description</h2>
  
  <p>Echo the  <strong>STRING</strong>(s) to standard output.</p>
  
  <p><strong>-n</strong> = do not output the trailing newline</p>
</blockquote>

<p><strong>TL;DR</strong>: You need to edit your <code>Secret</code> definition with new values:</p>

<ul>
<li><code>$ echo -n "website_user" | base64</code></li>
<li><code>$ echo -n "website" | base64</code></li>
<li><code>$ echo -n "pass" | base64</code></li>
</ul>

<hr>

<p>You created your <code>Secret</code> with a trailing newline. Please take a look at below example:</p>

<ul>
<li><code>POSTGRES_USER</code>: 

<ul>
<li><code>$ echo "website_user" | base64</code>

<ul>
<li>output: <code>d2Vic2l0ZV91c2VyCg==</code> which is the same as yours </li>
</ul></li>
<li><code>$ echo -n "website_user" | base64</code>

<ul>
<li>output: <code>d2Vic2l0ZV91c2Vy</code> which is the <strong>correct</strong> value </li>
</ul></li>
</ul></li>
<li><code>POSTGRES_PASSWORD</code>: 

<ul>
<li><code>$ echo "pass" | base64</code>

<ul>
<li>output: <code>cGFzcwo=</code> which is the same as yours </li>
</ul></li>
<li><code>$ echo -n "pass" | base64</code>

<ul>
<li>output: <code>cGFzcw==</code> which is the <strong>correct</strong> value </li>
</ul></li>
</ul></li>
<li><code>POSTGRES_DB</code>: 

<ul>
<li><code>$ echo "website" | base64</code>

<ul>
<li>output: <code>d2Vic2l0ZQo=</code> which is the same as yours </li>
</ul></li>
<li><code>$ echo -n "website" | base64</code>

<ul>
<li>output: <code>d2Vic2l0ZQ==</code> which is the <strong>correct</strong> value </li>
</ul></li>
</ul></li>
</ul>

<p>Your <code>Secret</code> should look like that: </p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: postgres-credentials
type: Opaque
data:
  POSTGRES_USER: d2Vic2l0ZV91c2Vy
  POSTGRES_PASSWORD: cGFzcw==
  POSTGRES_DB: d2Vic2l0ZQ==
</code></pre>

<p>If you create it with a new <code>Secret</code> you should be able to connect to the database: </p>

<pre class="lang-sh prettyprint-override"><code>root@postgres-deployment-64d697868c-njl7q:/# psql -h $(hostname -i) -U website_user -p 5432 website
Password for user website_user: 
psql (9.6.6)
Type "help" for help.

website=# 
</code></pre>

<p>Please take a look on additional links:</p>

<ul>
<li><a href="https://github.com/kubernetes/kubernetes/issues/70241#issuecomment-434242145" rel="noreferrer">Github.com: Kubernetes: issues: Config map vs secret to store credentials for Postgres deployment</a></li>
<li><a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="noreferrer">Kubernetes.io: Secrets</a></li>
</ul>
