title: Connect application to postgresql cluster using tls
body: <p>I have sucecssfully installed a crunchy data postgres cluster with tls certificates from cert-manager on kubernetes by following this tutorial.
  <a href="https://blog.crunchydata.com/blog/using-cert-manager-to-deploy-tls-for-postgres-on-kubernetes" rel="nofollow noreferrer">https://blog.crunchydata.com/blog/using-cert-manager-to-deploy-tls-for-postgres-on-kubernetes</a></p>
  <p><code>kubectl -n postgres-operator get secrets</code></p>
  <pre><code>NAME                           TYPE                                  DATA   AGE
  default-token-w7mnw            kubernetes.io/service-account-token   3      45h
  pgo-token-9t7dw                kubernetes.io/service-account-token   3      45h
  pgo-root-cacert                Opaque                                2      45h
  hippo-repl-tls                 kubernetes.io/tls                     3      45h
  hippo-tls                      kubernetes.io/tls                     3      45h
  hippo-instance-token-mmxfj     kubernetes.io/service-account-token   3      45h
  hippo-00-5klh-certs            Opaque                                4      45h
  hippo-00-rsvm-certs            Opaque                                4      45h
  hippo-pguser-hippo             Opaque                                7      45h
  hippo-ssh                      Opaque                                3      45h
  hippo-pgbackrest-token-hcp7m   kubernetes.io/service-account-token   3      45h
  </code></pre>
  <p>Most of these secrets contain something to do with tls for example hippo-tls contains a &quot;ca.crt&quot;, &quot;tls.crt&quot;, &quot;tls.key&quot; and the pgo-root-cacert secret contains a &quot;root.crt&quot;, &quot;root.key&quot;. Im not sure which one to use for connecting my application to my database.</p>
  <p>This is my deployment yaml for my application</p>
  <pre><code>---
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: admin-app
    namespace: postgres-operator
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: admin-app
    template:
      metadata:
        labels:
          app: admin-app
      spec:
        containers:
          - name: admin-app
            image: localhost:32000/wtl-admin3.2:registry
            env:
            - name: CA_CERT
              valueFrom: {secretKeyRef: {name: pgo-root-cacert, key: root.crt}}
            - name: TLS_CERT
              valueFrom: {secretKeyRef: {name: hippo-tls, key: tls.crt}}
            - name: TLS_KEY
              valueFrom: {secretKeyRef: {name: hippo-tls, key: tls.key}}
  #          imagePullPolicy: Never
            ports:
            - containerPort: 80
            resources:
              limits:
                memory: &quot;100Mi&quot;
                cpu: &quot;100m&quot;
  </code></pre>
  <p>This is my first time working with tls so im not really sure how to connect with it. This is my Golang postgres connection file.</p>
  <pre><code>package infastructure
  
  import (
          &quot;context&quot;
          &quot;crypto/tls&quot;
          &quot;crypto/x509&quot;
          &quot;fmt&quot;
          &quot;log&quot;
          &quot;os&quot;
  
          &quot;github.com/go-pg/pg/v10&quot;
          &quot;github.com/go-pg/pg/v10/orm&quot;
  )
  
  func ConnectTls(ctx context.Context) *pg.DB {
          cert, err := tls.X509KeyPair([]byte(os.Getenv(&quot;TLS_CERT&quot;)), []byte(os.Getenv(&quot;TLS_KEY&quot;)))
          if err != nil {
                  log.Printf(&quot;failed to load client certificate: %v&quot;, err)
                  log.Println(err)
                  panic(err)
          }
  
          CACertPool := x509.NewCertPool()
          CACertPool.AppendCertsFromPEM([]byte(os.Getenv(&quot;CA_CERT&quot;)))
  
          tlsConfig := &amp;tls.Config{
                  Certificates:       []tls.Certificate{cert},
                  RootCAs:            CACertPool,
                  InsecureSkipVerify: true,
                  // ServerName:         &quot;localhost&quot;,
          }
  
          opt := &amp;pg.Options{
  
                  Addr:      &quot;hippo-primary.postgres-operator.svc:5432&quot;,
                  User:      &quot;hippo&quot;,
                  Password:  &quot;1XNrN1H-AF)=S(U_9*6(A0V7&quot;,
                  Database:  &quot;hippo&quot;,
                  TLSConfig: tlsConfig,
          }
          DB := pg.Connect(opt)
          if err := DB.Ping(ctx); err != nil {
                  log.Print(&quot;failed to connect&quot;)
                  log.Print(err)
          }
          return DB
  }
  
  </code></pre>
  <p>I've tried to connect using the different secrets in the postgres operator namespace but i usually get the same error about not using tls. I'm also not sure what the ServerName should be for the tls config.</p>
  <p><code>kubectl -n postgres-operator logs admin-app-b7d97764d-lkrqn</code></p>
  <pre><code>2021/09/03 17:48:46 failed to connect
  2021/09/03 17:48:46 pg: SASL: got &quot;SCRAM-SHA-256-PLUS&quot;, wanted &quot;SCRAM-SHA-256&quot;
  panic: pg: SASL: got &quot;SCRAM-SHA-256-PLUS&quot;, wanted &quot;SCRAM-SHA-256&quot;
  
  </code></pre>