<ul>
<li>Followed instructions <a href="https://www.cockroachlabs.com/docs/stable/secure-a-cluster.html" rel="nofollow noreferrer">here</a> to create a local 3 node <strong>secure cluster</strong></li>
<li><p>Got the go example <a href="https://www.cockroachlabs.com/docs/v2.0/build-a-go-app-with-cockroachdb.html" rel="nofollow noreferrer">app</a> running with the following DB connection string to connect to the <strong>secure cluster</strong></p>

<p><code>sql.Open("postgres", "postgresql://root@localhost:26257/dbname?sslmode=verify-full&amp;sslrootcert=&lt;location of ca.crt&gt;&amp;sslcert=&lt;location of client.root.crt&gt;&amp;sslkey=&lt;location of client.root.key&gt;")</code></p></li>
</ul>

<p>Cockroach DB worked well locally so I decided to move the DB (as in the DB solution and not the actual data) to GCP Kubernetes Engine using the instructions <a href="https://www.cockroachlabs.com/docs/v2.0/orchestrate-cockroachdb-with-kubernetes.html" rel="nofollow noreferrer">here</a></p>

<p>Everything worked fine - pods created and could use the built in SQL client from the cloud console.</p>

<p>Now I want to use the previous example app to now connect to this new cloud DB. I created a load balancer using <code>kubectl expose</code> command and got a public ip to use in the code.</p>

<p>How do I get the new <code>ca.crt, client.root.crt, client.root.key</code> files to use in my connection string for the DB running on GCP?</p>

<p>We have 5+ developers and the idea is to have them write code on their local machines and connect to the cloud db using the connection strings and the certificates.</p>

<p>Or is there a better way to let 5+ developers use a single DEV DB cluster running on GCP?</p>

samstride
<p>The recommended way to run against a Kubernetes CockroachDB cluster is to have your apps run in the same cluster. This makes certificate generation fairly simple. See the <a href="https://www.cockroachlabs.com/docs/v2.0/orchestrate-cockroachdb-with-kubernetes.html#step-5-use-the-built-in-sql-client" rel="nofollow noreferrer">built-in SQL client</a> example and its <a href="https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/client-secure.yaml" rel="nofollow noreferrer">config file</a>.</p>

<p>The config above uses an init container to send a CSR for client certificates and makes them available to the container (in this case just the cockroach sql client, but it would be anything else).</p>

<p>If you wish to run a client outside the kubernetes cluster, the simplest way is to copy the generated certs directly from the client pod. It's recommended to use a non <code>root</code> user:</p>

<ul>
<li><a href="https://www.cockroachlabs.com/docs/v2.0/create-user.html#main-content" rel="nofollow noreferrer">create the user</a> through the SQL command</li>
<li>modify the <a href="https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/client-secure.yaml" rel="nofollow noreferrer">client-secure.yaml</a> config for your new user and start the new client pod</li>
<li>approve the CSR for the client certificate</li>
<li>wait for the pod to finish initializing</li>
<li>copy the <code>ca.crt</code>, <code>client.&lt;username&gt;.crt</code> and <code>client.&lt;username&gt;.key</code> from the pod onto your local machine</li>
</ul>

<p><strong>Note</strong>: the public DNS or IP address of your kubernetes cluster is most likely <strong>not</strong> included in the node certificates. You either need to modify the <a href="https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/cockroachdb-statefulset-secure.yaml#L171" rel="nofollow noreferrer">list of hostnames/addresses</a> before bringing up the nodes, or change your connection URL to <code>sslmode=verify-ca</code> (see <a href="https://www.cockroachlabs.com/docs/v2.0/connection-parameters.html#secure-connections-with-urls" rel="nofollow noreferrer">client connection parameters</a> for details).</p>

<p>Alternatively, you could use password authentication in which case you would only need the CA certificate.</p>
