External Database via pg_service.conf

[damonearp]

Is there anyway to tell harbor to connect to an external database with a connection string like service=harbor?

We're trying to get harbor working with Vault database credentials which are short lived and injected into containers by the vault-agent. I assume that having vault-agent updating the harbor.yml regularly will not be enough, as we'd need to trigger a reload of the configuration by harbor. In the past we've had vault-agent simply provide a pg_service.conf file and by setting the env PGSERVICEFILE= we can rely on libpq to reread that file on connection ensuring updated creds.

From the template config, I'm not sure this can be done.

Thanks

external_database:
  harbor:
    host: harbor_db_host
    port: harbor_db_port
    db_name: harbor_db_name
    username: harbor_db_username
    password: harbor_db_password
    ssl_mode: disable
    max_idle_conns: 2
    max_open_conns: 0

[wy65701436]

per currently design, DB setting is a kind of system settings, it has to restart core to make it work. If you want refresh the credentials, you have to update the env about the DB password in the core container.

[damonearp]

I poked through the code a few weeks ago. In terms of pg_service.conf: even if harbor accepted a connect string, I didn't get a sense that github.com/lib/pq supports it and the only references to pgx (only in go.sum it seems) were for versions before they supported this file and the PGSERVICE= env var.

The nice thing about a connect string that points to an external file though is core would never need to be restarted or even SIGHUP'd, just jobservice would need access to a pg_service.conf file as well. No creds being transfered between pods (via tls or in the clear).