A walkthrough of running OpenBao on Kubernetes with
CloudNativePG as its PostgreSQL storage
backend. Every layer of this stack is open source, with no vendor lock-in:
Kubernetes and CloudNativePG are both CNCF
projects, authenticated entirely over TLS client certificates via the 1.30
DatabaseRole CRD, with no passwords anywhere in the stack. Co-authored
with Rob Kenefeck from
ControlPlane.
CloudNativePG 1.30 introduces the DatabaseRole CRD and built-in TLS client
certificate issuance, letting application teams own their PostgreSQL
credentials declaratively and connect without ever handling a password.
Dive into the nitty-gritty of how CloudNativePG works its magic with PostgreSQL cluster stuff, zooming in on configmaps and secrets. Peek behind the curtain of the default Private Key Infrastructure – the secret sauce for stress-free mutual TLS authentication. Get to know the default user and database setups, all decked out for maximum security. This article is your go-to roadmap, cruising through CloudNativePG’s resource wizardry and dishing out real-world tips for a breeze in deploying and handling PostgreSQL clusters.