# FATAL: SSL required when connecting to Percona Everest postgres engine **URL:** \ **Category:** Percona Everest\ **Tags:** postgresql\ **Created:** [July 23, 2024, 7:33am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763 "2024-07-23T07:33:45Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 23, 2024, 7:33am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/1 "2024-07-23T07:33:45Z")
Hi All, Have anyone faced this error when connecting to the postgresql after created it with Percona Everest? psql -h 10.28.130.243 -U postgres psql: error: connection to server at “10.28.130.243”, port 5432 failed: FATAL: server login has been failing, try again later (server\_login\_retry) connection to server at “10.28.130.243”, port 5432 failed: FATAL: SSL required I already configured to allow external access for 0.0.0.0/0 Do I have to add any database engine parameters while launch the db cluster? Thanks ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 23, 2024, 8:12am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/2 "2024-07-23T08:12:25Z")
> [@duytq02](#): > > psql -h 10.28.130.243 -U postgres Hi, just created a new cluster in GKE for a test, installed Percona Everest and created a PG cluster (External Access enabled 0.0.0.0/0). ![Screenshot 2024-07-23 at 12.15.25 PM](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/1/9/1906e72663700cd0a88b438e982f48b016dcb84f.png) Installed psql using brew on my mac, ```auto brew install libpq brew link --force libpq ``` Tried to connect and it was successful. ![Screenshot 2024-07-23 at 12.09.56 PM](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/0/2/025be08242bfb58942a018e4ac5f3f1b24056ed0.png) Perhaps some policies or settings on your k8s cluster are getting in the way. ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 23, 2024, 8:18am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/3 "2024-07-23T08:18:56Z")
Try connecting from inside the cluster. using a pod with Percona Distribution > **[Percona Operator for PostgreSQL - 2 Connect to PostgreSQL](https://docs.percona.com/percona-operator-for-postgresql/2.0/connect.html)** > > When the installation is done, we can connect to the cluster. or using pgAdmin > **[Running pgAdmin to Manage a PostgreSQL Cluster on Kubernetes](https://dev.to/dbazhenov/running-pgadmin-to-manage-a-postgresql-cluster-in-kubernetes-616)** > > Let’s say you need to do something in PostgreSQL in Kubernetes, and it is inconvenient to work with... ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 23, 2024, 10:36am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/4 "2024-07-23T10:36:20Z")
Hi @daniil.bazhenov, I installed pgadmin4 and tried to connect to the db through the pgbouncer service by it cluster ip but it still show the SSL error ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/a/f/afe6b0e5ef1873e5859d877c4e02df8ae13b881c.png) Can you show me the Database engine parameters of the postgres db you created earlier? because I am afraid that I’m missing something by leaving it empty Thanks ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 23, 2024, 2:30pm UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/5 "2024-07-23T14:30:34Z")
Hi, I haven’t done any special settings or configurations. What cloud or environment are you using? Look at the connection settings, Advanced section in pgAdmin connect, maybe there is an option to turn off SSL. I also connected my Golang app to Percona Everest PG today. I was getting an error message about SSL until I removed the sslmode=disable parameter. before: `dsn := "host=localhost user=gorm password=gorm dbname=gorm port=5432 sslmode=disable"` after `dsn := "host=localhost user=gorm password=gorm dbname=gorm port=5432"` ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 2:39am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/6 "2024-07-24T02:39:26Z")
Hi @daniil.bazhenov, I am currently testing in my private environment. Deployed Percona Everest in a RKE2 cluster. In this env, every outbound traffic to the internet must go through a proxy server. I have already configured the proxy env in node and containerd, even in the everest subscription. I was able to provision and connect to Mongo db and Mysql but got this issue on Postgres 😃 As you can see I was trying to connect for many ssl modes but no luck although I can nc to see the port 5432 is open and working ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/4/2/42bc02d5e1a19a31b9c96bcc14900285a9a8e43e.png) Also I want to know where these config should go to the k8s cluster: ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/2/3/232fa127865a8bffd2ce521d6e15995ec008af3f.png) Do they applied to one of these configmap? ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/f/0/f0dc2a7067f805a6073773db47e71d2dbed962ba.png) ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 24, 2024, 8:18am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/7 "2024-07-24T08:18:01Z")
Try the second option as in your screenshot, but specify the password in single quotes (') do not specify sslmode at all `psql "user=postgres password='YOUR_PASSWORD' dbname=postgres host=HOST_IP port=5432"` ![Screenshot 2024-07-24 at 12.18.08 PM](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/b/b/bbf2351d142c433b7e95432ecc98f360eb2f53e7.png) ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 8:57am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/8 "2024-07-24T08:57:49Z")
hi @daniil.bazhenov , I didn’t leave the password in the single quotes 😃 ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 10:26am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/9 "2024-07-24T10:26:19Z")
hi @daniil.bazhenov I believe I have found something. I created a pod run with image perconalab/percona-distribution-postgresql:13.2 and then I accessed to the pod and tried to psql to my postgres db. I used the service pg bouncer as the pg host and failed: ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/2/6/2621514b354372b3a53fe296152f84b9387ab063.png) But then I switched the host to the pg primary service and I was able to access my DB ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/5/f/5fd6c7a046a341032fe895bc9913ab44262a05f0.png) I think there’s something wrong with the pgbouncer service or I’m missing some configuration on it ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 24, 2024, 10:47am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/10 "2024-07-24T10:47:00Z")
try image with pg version 16, not 13.2 ```auto --image=perconalab/percona-distribution-postgresql:16 ``` ```auto kubectl run -i --rm --tty pg-client --image=perconalab/percona-distribution-postgresql:16 --restart=Never -- psql $PGBOUNCER_URI ``` > **[Percona Operator for PostgreSQL - 2 Connect to PostgreSQL](https://docs.percona.com/percona-operator-for-postgresql/2.0/connect.html)** > > When the installation is done, we can connect to the cluster. ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 10:55am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/11 "2024-07-24T10:55:31Z")
Same result. ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/4/1/415501dc0912f85ac991f95c5fa3bd6afdf5994b.png) Do the password still the same if I access through the pgbouncer? ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 11:13am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/12 "2024-07-24T11:13:25Z")
Ah I found some interesting logs when I tried to login using the pgbouncer address: ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/6/1/61149f83c680d443bcce418c0d23868e9d1fc7d6.png) looks like the pgbouncer can not find the pg primary service due to DNS lookup fail. Do we have this issue before? ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 24, 2024, 11:13am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/13 "2024-07-24T11:13:46Z")
I tried it now, and this command worked: ```auto kubectl run -i --rm --tty pg-client --image=perconalab/percona-distribution-postgresql:16 -n app --restart=Never -- psql "host=pg-test-pgbouncer.app.svc port=5432 user=postgres password='YOU_PASSWORD' dbname=postgres" ``` ![Screenshot 2024-07-24 at 3.15.08 PM](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/7/b/7b826b137aeace64b3797d90bc2cc4e1b3265e0f.png) ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 24, 2024, 11:17am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/14 "2024-07-24T11:17:21Z")
![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/4/9/49f2458ca883d933267930e10f2c3560e94cfa4f.png) I don’t think this issue is related to the command anymore 😃 I think the pgbouncer service couldn’t resovle the address of the pg-primary service as the logs I captured on the last comment ---
**Author:** ![daniil.bazhenov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/daniil.bazhenov/32/62_2.png) [@daniil.bazhenov](https://forums.percona.com/u/daniil.bazhenov)\ **Post date:** [July 24, 2024, 11:22am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/15 "2024-07-24T11:22:38Z")
I don’t know, I need someone smarter. Maybe @Diogo_Recharte . ---
**Author:** ![Diogo\_Recharte](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/diogo_recharte/32/8004_2.png) [@Diogo\_Recharte](https://forums.percona.com/u/Diogo_Recharte)\ **Post date:** [July 24, 2024, 1:30pm UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/17 "2024-07-24T13:30:22Z")
After taking a closer look at the issue, it seems like you bumped into an old issue that’s impacting our PG operator. [This forum post](https://forums.percona.com/t/pgbouncer-server-dns-lookup-failed/19731) has a more detailed explanation of the issue and a couple of workarounds that worked for some users. However, I think you may have limited success trying these workarounds with Everest. We have escalated [this issue](https://perconadev.atlassian.net/browse/K8SPG-333) to our cloud team which will do a deeper investigation and will try to work on a fix in one of the upcoming PG operator releases. We’ll report back when an eventual fix is part of Everest. ---
**Author:** ![Diogo\_Recharte](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/diogo_recharte/32/8004_2.png) [@Diogo\_Recharte](https://forums.percona.com/u/Diogo_Recharte)\ **Post date:** [July 24, 2024, 2:27pm UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/18 "2024-07-24T14:27:45Z")
@duytq02 during this thread you asked another question that’s unrelated with the issue but I don’t want it to be unanswered. You asked if the DBEngine parameters you specified in the advanced settings in Everest UI get stored in a config map somewhere. They are not, they exist as part of the DatabaseCluster CR’s `.spec.engine.config` field that gets reconciled into the PerconaPGCluster CR’s `.spec.patroni.dynamicConfiguration.postgresql.parameters` (see [here](https://github.com/percona/percona-postgresql-operator/blob/36000771b7d185a7d9d51307e56726dd71afa28c/deploy/cr.yaml#L459)). You can check this field directly with the following command: ```auto kubectl get pg/ -n -o jsonpath='{.spec.patroni.dynamicConfiguration.postgresql.parameters}' ``` ---
**Author:** ![duytq02](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@duytq02](https://forums.percona.com/u/duytq02)\ **Post date:** [July 25, 2024, 6:24am UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/19 "2024-07-25T06:24:24Z")
Thanks @Diogo_Recharte for the information, I modified the PerconaPGCluster, expose the pg-ha service and now I can access that through the LoadBalancer IP of the pg-ha service of my db instead of the pgbouncer service. Anyway, How can I completely disable the pgboucer service? I don’t want to waste a LoadBalancer for a not working service. Can we do that by adding config to the DB Engine Parameters while creating the DB in the UI? ---
**Author:** ![Colin\_Griffin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/colin_griffin/32/17467_2.png) [@Colin\_Griffin](https://forums.percona.com/u/Colin_Griffin)\ **Post date:** [July 29, 2024, 12:22pm UTC](https://forums.percona.com/t/fatal-ssl-required-when-connecting-to-percona-everest-postgres-engine/31763/20 "2024-07-29T12:22:56Z")
This issue is also affecting us and is also seen with PGadmin