<p>Trying to deploy postgres in kubernetes (<a href="https://github.com/paunin/PostDock/tree/master/k8s/example2-single-statefulset" rel="nofollow noreferrer">https://github.com/paunin/PostDock/tree/master/k8s/example2-single-statefulset</a>), </p>

<ol>
<li>Used pgpool-II(2 replicas) along with 1 postgres-master pod &amp; 2 slave pods. </li>
</ol>

<pre><code>kubectl get pods -n postgres
NAME                                       READY   STATUS    RESTARTS   AGE
psql-db-pgpool-8****c-7**k             1/1     Running   0          35d
psql-db-pgpool-8****c-m**5             1/1     Running   0          35d
psql-db-node-0                         1/1     Running   0          35d
psql-db-node-1                         1/1     Running   0          35d
psql-db-node-2                         1/1     Running   0          20h
</code></pre>

<ol start="2">
<li>Created a user "test" from the master postgres db with postgres user. </li>
<li>When trying to connect from within the pods(node-0), the authentication is successful, with user "test".</li>
</ol>

<pre><code>root@postgres-db-node-0:/# psql -h localhost postgres -U test
psql (11.4 (Debian 11.4-1.pgdg90+1))
Type "help" for help.

postgres=&gt; \l
</code></pre>

<ol>
<li>When trying to connect with NodePort IP &amp; NodePort of the kubernetes cluster, the new user "test" fails authentication with <strong>pool_passwd file does not contain an entry for "test"</strong></li>
</ol>

<pre><code>psql -h NODE_IP -U test -d postgres --port NODE_PORT
psql: FATAL:  md5 authentication failed
DETAIL:  pool_passwd file does not contain an entry for "test"
</code></pre>

<ol start="5">
<li>Logged in to the pgpool-II pod to find out </li>
</ol>

<pre><code>root@psql-db-pgpool-8****c-7**k:/# cat /usr/local/etc/pool_passwd
user1:md5****422f
replica_user:md5****3
</code></pre>

<p>The new user "test" created at the database is not reflected at the pgpool. Does it work this way, to create &amp; update pgpool everytime a new user is created? Or am I missing something for this user update.</p>

Sandy
<p>The postgres example You deployed uses secret object to store user and password credentials. And this is the recommended way of managing sensitive data in 
kubernetes deployments.</p>

<p>There are following <a href="https://github.com/paunin/PostDock/blob/master/k8s/README.md#example-for-k8s" rel="nofollow noreferrer">instructions</a> in this example:</p>

<ul>
<li>Create namespace by  <code>kubectl create -f ./namespace/</code></li>
<li>Create configs:  <code>kubectl create -f ./configs/</code></li>
<li>Create volumes  <code>kubectl create -f ./volumes/</code></li>
<li>Create services  <code>kubectl create -f ./services/</code></li>
<li>Create nodes  <code>kubectl create -f ./nodes/</code></li>
<li>Create pgpool  <code>kubectl create -f ./pgpool/</code></li>
</ul>

<p>If You followed them in correct order, the <code>mysystem-secret</code> secret object is created when <code>kubectl create -f ./configs/</code> is called from <a href="https://github.com/paunin/PostDock/blob/master/k8s/example2-single-statefulset/configs/secret.yml" rel="nofollow noreferrer"><code>configs/secret.yml</code></a>.</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  namespace: mysystem
  name: mysystem-secret
type: Opaque
data:
  app.db.user: d2lkZQ== #wide
  app.db.password: cGFzcw== #pass
  app.db.cluster.replication.user: cmVwbGljYV91c2Vy #replica_user
  app.db.cluster.replication.password: cmVwbGljYV9wYXNz #replica_pass
  app.db.pool.users: d2lkZTpwYXNz #wide:pass
  app.db.pool.pcp.user: cGNwX3VzZXI= #pcp_user
  app.db.pool.pcp.password: cGNwX3Bhc3M= #pcp_pass
</code></pre>

<p><em>Note that the comments next to each encoded password is decoded password so in production setting it should be avoided.</em></p>

<p>Then the user and password credentials from <code>mysystem-secret</code> are used in <code>kubectl create -f ./nodes/</code> and <code>kubectl create -f ./pgpool/</code> as environmental values that are in all replicas and can be used to connect to Database.</p>

<pre><code>...
            - name: "POSTGRES_USER"
              valueFrom:
                secretKeyRef:
                  name: mysystem-secret
                  key: app.db.user
            - name: "POSTGRES_PASSWORD"
              valueFrom:
                secretKeyRef:
                  name: mysystem-secret
                  key: app.db.password
...
</code></pre>

<p>If You want to use Your own user and password You need to modify the <code>configs/secret.yml</code> file and replace passwords you wish to modify with base64 encoded passwords.</p>

<p>You can easily encode any password to base64 with following command:</p>

<pre><code>echo -n 'admin' | base64
YWRtaW4=
echo -n '1f2d1e2e67df' | base64
MWYyZDFlMmU2N2Rm
</code></pre>

<hr>

<p>Update:</p>

<p>To add additional users that would work with pgpool after cluster deployment you can use tool <a href="https://github.com/CrunchyData/postgres-operator" rel="nofollow noreferrer">postgres-operator</a>. Users added manually via exec to pod and then created locally would not be propagated to other nodes.</p>

<p>Follow <a href="https://access.crunchydata.com/documentation/postgres-operator/latest/installation/install-pgo-client/" rel="nofollow noreferrer">these</a> instructions to install Postgres Operator (pgo client) and configure it to work with kubernetes.</p>
