Is the connection to hosted postgres TLS 1.2 on public net and TLS 1.3 on private net?

Heya,

I know it’s been quite a while since the question was originally posted, but I would like to post an answer in case someone runs into it now in 2023.

It’s likely a TLS-related issue, but there are a few things you can check to diagnose and potentially fix the problem.

1. Check the CA certificate: Make sure that the CA certificate is correctly bundled within your Docker image and loaded by your Deno application. You mentioned that the CA cert is the same between your local machine and the Kubernetes cluster, which is good. However, it’s important to confirm this.

2. Check the TLS version: It’s possible that the issue is related to TLS version differences. TLS 1.3 introduced stricter validation rules compared to TLS 1.2. To address this, you can try explicitly specifying the TLS version your Deno application should use.

In your Deno code, before making the connection, try setting the minimum TLS version to 1.2 like this:

JavaScript

import { connect, Tls } from "https://deno.land/std/http/server.ts";

const tls: Tls = {
  // Other TLS settings
  minVersion: "TLSv1.2", // Specify the minimum TLS version
};

// Establish the connection with the above TLS configuration
const conn = await connect({
  hostname: "your-postgres-host",
  port: 5432,
  tls,
});

This may help ensure that the connection uses TLS 1.2, which might resolve the issue if there’s a TLS version mismatch.

3. Add more logging: To diagnose the issue more specifically, add more detailed logging to your Deno application. You can log the certificate validation process to see where it fails. For example, log the certificates being used, their expiration dates, etc.

4. Check DNS resolution: Make sure that the DNS resolution is working correctly in your Kubernetes cluster. Sometimes, connectivity issues can arise from DNS misconfigurations.

6. Check Kubernetes service configuration: Double-check the configuration of your PostgreSQL service in Kubernetes. Ensure that it’s correctly configured to listen on the private network.

7. Check for proxy: If there’s a proxy or reverse proxy involved, it might interfere with the TLS handshake. Make sure your Docker image and Kubernetes cluster are set up to handle proxies correctly.

8. Check CA certificate format: Ensure that the CA certificate is in the correct format and readable by Deno. It should be in PEM format.

9. Check Kubernetes Pod Security Policies: If you’re using Pod Security Policies in your Kubernetes cluster, they might be preventing certain network operations. Verify that the policies allow your application to establish outgoing network connections.

10. Check Kubernetes service names: Make sure that the PostgreSQL service name or IP used within your Kubernetes cluster is correct.

Hope that this helps!