Set PostgreSQL Credentials

Kloudfuse keeps the password for its PostgreSQL database (kfuse-configdb) in a Kubernetes secret named kfuse-pg-credentials. The configdb database and every Kloudfuse service that connects to it read the password from this secret.

By default, the Helm chart creates the secret for you with a default password (installKfusePgCredentials: true). On later upgrades it keeps the values already in the secret. To use a password of your own, create the secret yourself before you install, and tell the chart not to create it.

Create the secret

  1. Enter the password at a prompt that doesn’t echo it, so it never appears in your terminal or your shell history, and export it for the next step:

    printf 'PostgreSQL password: '; read -rs PG_PASSWORD; echo
export PG_PASSWORD

  2. Create the secret in the Kloudfuse namespace. The command uses kfuse, the namespace the standard Helm install uses; if you installed Kloudfuse in a different namespace, use that one, because the secret must be in the same namespace as the Helm release. The secret needs five keys: the services read different ones, and postgresql-password-encoded holds the URL-encoded form of the password for connection strings.

    PG_PASSWORD_ENCODED=$(python3 -c 'import os, urllib.parse; print(urllib.parse.quote(os.environ["PG_PASSWORD"], safe=""))')

kubectl create secret generic kfuse-pg-credentials \
  --namespace kfuse \
  --from-literal=postgres-password="$PG_PASSWORD" \
  --from-literal=postgresql-password="$PG_PASSWORD" \
  --from-literal=postgresql-postgres-password="$PG_PASSWORD" \
  --from-literal=postgresql-replication-password="$PG_PASSWORD" \
  --from-literal=postgresql-password-encoded="$PG_PASSWORD_ENCODED"

unset PG_PASSWORD PG_PASSWORD_ENCODED

Stop the chart from creating the secret

  1. In your custom-values.yaml file, set:

    installKfusePgCredentials: false
    yaml

  2. Install or upgrade Kloudfuse:

    helm upgrade --install kfuse oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/kfuse \
  -n kfuse \
  --version <VERSION> \ (1)
  -f custom-values.yaml
    bash
    1 Replace <VERSION> with a valid Kloudfuse release value. See Release Notes for the latest release.

With installKfusePgCredentials: false, the install fails with kfuse-pg-credentials secret is missing if the secret doesn’t exist yet. Create it first, as described in Create the secret.