Repository navigation
[Bug]: Bootstrap initdb is not setting my passwort in db #11670
Description
Is there an existing issue already for this bug?
- I have searched for an existing issue, and could not find anything. I believe this is a new bug.
I have read the troubleshooting guide
- I have read the troubleshooting guide and I think this is a new bug.
I am running a supported version of CloudNativePG
- I have read the troubleshooting guide and I think this is a new bug.
Contact Details
No response
Version
1.30 (latest patch)
What version of Kubernetes are you using?
1.36
What is your Kubernetes environment?
Self-managed: k3s
How did you install the operator?
Helm
What happened?
I have deployt the operator with helm over argocd from my git. It works fine
Then i would like to create the cluster
I have added the secret with my externel secret and i will show you the deployt secret in the cluster:
apiVersion: v1
data:
password: VGVzdDEyMw==
username: cmVub3ZhdGVfdXNlcg==
kind: Secret
metadata:
annotations:
reconcile.external-secrets.io/data-hash: af8f7969f253422767a0d372ba23d6f77cc89aa2f5d147572e888845
creationTimestamp: "2026-10-15T11:26:11Z"
labels:
cnpg.io/reload: "true"
reconcile.external-secrets.io/created-by: 247f3f61b4cb156aaf84acd43e7d73e0fb229e93823bfc04ebd05098
reconcile.external-secrets.io/managed: "true"
name: postgres-renovate-user
namespace: renovate
ownerReferences:
- apiVersion: external-secrets.io/v1
blockOwnerDeletion: true
controller: true
kind: ExternalSecret
name: ext-postgres-renovate-user
uid: 80ff83d2-2510-42a9-8b0b-e58ec5608c86
resourceVersion: "72365253"
selfLink: /api/v1/namespaces/renovate/secrets/postgres-renovate-user
uid: 9e264af0-1a22-4710-99bd-497eccf8768d
type: kubernetes.io/basic-authAfter i deployed this secret i have deplyoyt the Cluster yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: renovate-db
namespace: renovate
spec:
imageName: ghcr.io/cloudnative-pg/postgresql:18.6
instances: 1
startDelay: 300
stopDelay: 300
primaryUpdateStrategy: unsupervised
enableSuperuserAccess: true
superuserSecret:
name: postgres-renovate-superuser-secret
postgresql:
parameters:
shared_buffers: 256MB
pg_stat_statements.max: '10000'
pg_stat_statements.track: all
auto_explain.log_min_duration: '10s'
pg_hba:
- host all all all password
- host all all all md5
logLevel: debug
storage:
storageClass: local-path
size: 30Gi
bootstrap:
initdb:
database: renovate
owner: renovate_user
secret:
name: postgres-renovate-userIt works fine and the cluster is healty but when i try to login with the password from the secret i get an error:
kubectl exec -it -n renovate renovate-db-1 -- bash
Defaulted container "postgres" out of: postgres, bootstrap-controller (init)
postgres@renovate-db-1:/$ PGPASSWORD='Test123' psql -h localhost -U renovate_user renovate -c 'select 1'
psql: error: connection to server at "localhost" (::1), port 5432 failed: FATAL: password authentication failed for user "renovate_user"
connection to server at "localhost" (::1), port 5432 failed: FATAL: password authentication failed for user "renovate_user"
postgres@renovate-db-1:/$ psql -U postgres -c '\du'
psql -U postgres -c "select rolname, rolcanlogin, rolpassword is not null as has_pw, left(rolpassword,14) from pg_authid where rolname='renovate_user';"
List of roles
Role name | Attributes
-----------------------+------------------------------------------------------------
cnpg_metrics_exporter |
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS
renovate_user |
streaming_replica | Replication
rolname | rolcanlogin | has_pw | left
---------------+-------------+--------+------
renovate_user | t | f |
(1 row)
Why is the "has_pw" Flag on false?
What can i do?
Cluster resource
Relevant log output
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity