Configure external PostgreSQL

Configure Splunk AppDynamics Virtual Appliance to store Secure Application data in self-managed PostgreSQL.

1. Prepare a PostgreSQL service that meets the supported contract.

   Requirement	Value
   Major version	17
   Encoding	UTF8
   Writer	Stable DNS endpoint that accepts read/write connections
   Reader	Optional; an empty reader host uses the writer host and port
   Authentication	Static username and password using SCRAM-SHA-256
   TLS	Required with verify-full host name verification
   Bootstrap role	LOGIN, CREATEDB, and CREATEROLE, with CONNECT on the bootstrap database Note: Keep the bootstrap role and its credentials available after installation. The Virtual Appliance uses them internally if you install SecureApp later. The role does not require superuser privileges.
   Bootstrap database	Existing UTF8 database, normally postgres
   Extensions	citext and pgcrypto available on the server
   Connection headroom	At least 70 ordinary-role connection slots available at validation time

   Client-certificate, IAM, Kerberos, LDAP, and other short-lived database authentication methods are not supported by this contract.

   Do not create the cisco-secureapp database or its application roles. Secure Application database management creates and manages them.

2. Configure a stable writer endpoint and optional reader endpoint.

   The writer must remain writable after provider failover. If you configure a reader, it must serve the same data and use the same authentication and CA trust contract.

   The 70-connection threshold is an installation prerequisite, not a production sizing recommendation. Provide additional capacity for application load, monitoring, maintenance, failover, and growth.

3. Verify network, DNS, and TLS access from OpenShift.
   • Confirm that OpenShift pods resolve each database host name.
   • Configure routing, return routing, firewall or security-group rules, egress rules, and NetworkPolicies.
   • Confirm that every configured host name appears in the server certificate SAN.
   • Provide a CA bundle that contains public certificates only and validates both writer and reader certificates.

   Do not turn off TLS verification or use an IP address that is absent from the certificate SAN.

4. Configure the PostgreSQL endpoint in config/external-postgresql.yaml.
   CODECopy

   statefulServices: postgresql: schemaVersion: 1 external: writer: host: postgres-writer.example.com port: 5432 reader: host: "" port: 5432 database: postgres tls: mode: verify-full ca: delivery: byokManaged secretName: postgres-external-ca credentials: delivery: byokManaged secretName: postgres-client-postgres-secret validation: enabled: true requiredMajorVersion: 17 minimumAvailableConnections: 70

   statefulServices:
     postgresql:
       schemaVersion: 1
       external:
         writer:
           host: postgres-writer.example.com
           port: 5432
         reader:
           host: ""
           port: 5432
         database: postgres
         tls:
           mode: verify-full
           ca:
             delivery: byokManaged
             secretName: postgres-external-ca
         credentials:
           delivery: byokManaged
           secretName: postgres-client-postgres-secret
         validation:
           enabled: true
           requiredMajorVersion: 17
           minimumAvailableConnections: 70

   Use DNS names for nonempty hosts, integer ports from 1 through 65535, and a bootstrap database other than cisco-secureapp. Keep TLS mode verify-full and validation enabled.

   Important: Do not set postgresql.external.database to cisco-secureapp. Secure Application creates and manages this database and its application objects when you deploy Secure Application.
5. Choose PostgreSQL Secret delivery.

   Add the bootstrap username, password, and server CA to config/secrets.yaml. Virtual Appliance creates and distributes the required Secrets.

6. Verify external PostgreSQL during installation.

   The validator checks writer and optional reader connectivity, TLS identity, SCRAM-SHA-256 authentication, version, encoding, writer state, role privileges, extensions, and connection headroom.

   If validation fails, inspect the retained logs:

   CODECopy

   kubectl logs -n <postgresql-namespace> job/postgres-external-validator

   kubectl logs -n <postgresql-namespace> job/postgres-external-validator

   Correct PostgreSQL, the network, the configuration, or the source Secrets, and then run the installation again.

7. Verify PostgreSQL after installation.
   CODECopy

   helm status postgres-external -n <postgresql-namespace> helm status postgres-external-consumer-gate -n <secureapp-namespace>

   helm status postgres-external -n <postgresql-namespace>
   helm status postgres-external-consumer-gate -n <secureapp-namespace>

   Confirm that Secure Application workloads become ready and that the required credential and CA Secrets exist in the Secure Application namespace. Do not print or decode Secret data.