Use PostgreSQL and MongoDB Flex with Kubernetes Engine
Last updated on
The following article describes the integration of PostgreSQL Flex and MongoDB Flex services with your STACKIT Kubernetes Engine (SKE) cluster.
Prerequisites
Section titled “Prerequisites”- An existing SKE cluster. If you haven’t created one, follow the Getting started documentation.
- Permissions to access the STACKIT Portal and the OpenStack CLI.
- Basic familiarity with Kubernetes and
kubectl.
Get the IP of your clusters router
Section titled “Get the IP of your clusters router”To allow your SKE cluster to connect to the database, you must determine its public egress IP address and add it to the database instance’s access control list (ACL). Note that the egress IP may consist of multiple ranges — add all of them to the ACL, not just a single address.
Via the STACKIT Portal
Section titled “Via the STACKIT Portal”- Go to Networking > Routers.
- Select the router named after your cluster.
- Go to interfaces.
- There will be two entries. One is a Private IP Address
(10.x.x.x)and the other is your routers Public IP Address. You need your Public IP Address.
Via OpenStack CLI
Section titled “Via OpenStack CLI”- Go to Infrastructure API in the Access section.
- Create a user access token.
- Download your OpenRC file and source it.
source $HOME/Downloads/openrcList your routers
openstack router listThe result will look like this
+--------------------------------------+--------------------------------+--------+-------+----------------------------------+| ID | Name | Status | State | Project |+--------------------------------------+--------------------------------+--------+-------+----------------------------------+| b4505724-9387-46aa-acc0-39f6b8f0f064 | shoot--c1fe92c6ca--cl-ysscfu28 | ACTIVE | UP | ef6d65ccc54640a5b4371d5cad8e95ed |+--------------------------------------+--------------------------------+--------+-------+----------------------------------+Get your routers Public IP Address
openstack router show <ROUTER-ID>The result will look like this
+-------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+| Field | Value |+-------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+| admin_state_up | UP || availability_zone_hints | || availability_zones | || created_at | 2023-07-03T13:03:35Z || description | || enable_ndp_proxy | None || external_gateway_info | {"network_id": "970ace5c-458f-484a-a660-0903bcfd91ad", "external_fixed_ips": [{"subnet_id": "599b9753-d6aa-4062-9489-707744e07004", "ip_address": "45.135.247.50"}], "enable_snat": true} || flavor_id | None || id | b4505724-9387-46aa-acc0-39f6b8f0f064 || interfaces_info | [{"port_id": "b444cbc1-8358-49bf-82a7-0aeaa3319141", "ip_address": "10.250.0.1", "subnet_id": "7feed2f4-5925-475b-ad4b-d2345fbadb53"}] || name | shoot--c1fe92c6ca--cl-ysscfu28 || project_id | ef6d65ccc54640a5b4371d5cad8e95ed || revision_number | 4 || routes | || status | ACTIVE || tags | || tenant_id | ef6d65ccc54640a5b4371d5cad8e95ed || updated_at | 2023-07-03T13:04:10Z |+-------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+You can find your Public IP Address under external_gateway_info → external_fixed_ips → ip_address.
You could also get your Public IP with this command. Filter by the cluster router name to avoid picking the wrong router in multi-cluster projects:
openstack router show $(openstack router list -f json | jq ".[] | select(.Name | startswith(\"shoot--<cluster-name>\")) | .ID" -r) -f json | jq ".external_gateway_info.external_fixed_ips[0].ip_address"Alternatively, use the STACKIT CLI to describe your SKE cluster, which exposes the egress IP information natively.
- Create a PostgreSQL Flex instance or MongoDB Flex instance and add your Public IP Address to the ACL IP list with
CIDR /32<PUBLIC-IP>/32 - Create a user to access the instance
- Copy your URI
When constructing the connection URI, use TLS/SSL. For PostgreSQL, append sslmode=require to the URI. For MongoDB, use the tls=true parameter in the connection string. See the PostgreSQL SSL documentation and MongoDB TLS/SSL documentation for details.
Create a Kubernetes Secret containing your credentials. Do not pass credentials as plain command-line arguments in production, as they may end up in shell history:
PostgreSQL
kubectl create secret generic postgres-connection \ --from-literal=POSTGRES_URI='postgresql://<user>:<password>@<host>:<port>/<database>?sslmode=require'Or with individual fields:
kubectl create secret generic postgres-connection \ --from-literal=POSTGRES_HOST=<postgres-host> \ --from-literal=POSTGRES_PORT=<postgres-port> \ --from-literal=POSTGRES_DATABASE=<postgres-database> \ --from-literal=POSTGRES_USER=<postgres-user> \ --from-literal=POSTGRES_PASSWORD=<postgres-password>MongoDB
kubectl create secret generic mongodb-connection \ --from-literal=MONGODB_URI='mongodb+srv://<user>:<password>@<host>/?tls=true'Use the secret in your application.
Terraform
Section titled “Terraform”For reproducible platform setups, the entire flow can be expressed in Terraform: create the DB Flex instance, obtain the SKE cluster’s egress_address_ranges, configure the database ACL, and inject credentials into Kubernetes without exposing them in Terraform outputs. See the Terraform resources for stackit_postgresflex_instance, stackit_mongodbflex_instance, and stackit_ske_cluster for details.