Postgres workload credentials ¶

When an Application or Job uses a Postgres database, Postgres provides connection settings as environment variables. Workloads authenticate with TLS client certificates; no password is provided.

Environment variables ¶

Each credential set contains these variables:

Variable	Value
`PGHOST`	Database hostname
`PGPORT`	Database port
`PGDATABASE`	Database name
`PGUSER`	Database username
`PGSSLMODE`	TLS verification mode
`PGSSLCERT`	Path to the workload's client certificate
`PGSSLKEY`	Path to the workload's client key
`PGSSLROOTCERT`	Path to the CA certificate

Roles and prefixes ¶

The role controls which credential sets the workload receives:

Role	Credential prefixes	Intended use
`admin`	Unprefixed and `READWRITE_`	Schema migrations and ordinary application traffic
`readwrite`	`READWRITE_`	Ordinary application traffic
`read`	`READ_`	Read-only application traffic

admin is the default role.

For example, a readwrite credential has variables such as READWRITE_PGHOST and READWRITE_PGDATABASE.

When you set envPrefix, it is prepended before the role prefix. With envPrefix: MYDB_, a readwrite credential has variables such as MYDB_READWRITE_PGHOST.

When envPrefix is not set, PostgreSQL clients that support standard PG* environment variables work out of the box with the unprefixed admin credentials. Use the READWRITE_ credentials for the long-running application process when the workload also runs schema migrations.