Provision PostgreSQL for SeekrFlow

SeekrFlow persists data for its services in PostgreSQL 16 or higher. You create the instance. SeekrFlow creates its own databases and roles inside it during configuration.

Create the instance

Amazon Web Services (AWS)
On-premises

Create an Amazon Aurora PostgreSQL-Compatible Edition or Amazon Relational Database Service (Amazon RDS) for PostgreSQL database. See Creating an Amazon Aurora DB cluster or Creating an Amazon RDS DB instance.SeekrFlow connects to the database with a username and password, from inside your virtual private cloud (VPC). To set both, create the database with full configuration. Express configuration allows only AWS Identity and Access Management (IAM) authentication and places the database outside a VPC.If you use a serverless option, configure it so it never pauses or scales to zero. SeekrFlow keeps database connections open and expects the database to stay available.Use the settings in this table. For security and backups, follow your organization’s requirements.

Setting	What SeekrFlow needs
Engine	Aurora (PostgreSQL Compatible) or PostgreSQL, version 16 or later.
Storage	Start with 500 GB. Aurora grows storage automatically.
Admin credentials	Any username and password. SeekrFlow uses this admin login to create its databases and run migrations. In the console, this is the Master username field. If you choose to manage the password in AWS Secrets Manager, get it from Secrets Manager before you create the SeekrFlow secrets.
VPC	The VPC your cluster runs in.
Security group	Inbound traffic on port 5432 from the cluster, such as from the cluster security group. A new security group created in the console allows only your own IP address. Add the rule for the cluster after you create the database.
Public access	Not needed. If the instance is reachable only from inside the VPC, `sfe db setup` can create SeekrFlow’s databases from a job in the cluster.

Run PostgreSQL on your own compute or as a stateful set in Kubernetes. The chart doesn’t install PostgreSQL. Use the settings in this table. For security and backups, follow your organization’s requirements.

Setting	What SeekrFlow needs
Engine	PostgreSQL 16 or later.
Storage	Start with 500 GB.
Admin credentials	An admin account SeekrFlow can use to create its databases and run migrations, such as `postgres`.
Authentication	Password authentication. SeekrFlow connects with a username and password.
Network access	Inbound traffic on port 5432 from the cluster.

The chart runs database migrations during installation. The instance must be reachable from the cluster before you install.

Check the instance

To confirm that the cluster can reach the instance, run pg_isready from a temporary pod. Replace <instance-hostname> with your instance endpoint.

kubectl run pg-check --restart=Never --image=postgres --command -- pg_isready -h <instance-hostname> -p 5432
kubectl wait --for=jsonpath='{.status.phase}'=Succeeded pod/pg-check --timeout=120s
kubectl logs pg-check

The output includes accepting connections. Then delete the test pod:

kubectl delete pod/pg-check

Generate role passwords

SeekrFlow creates two login roles in the instance when you connect SeekrFlow to PostgreSQL. Generate a password for each now:

echo "seekrflow_app:      $(openssl rand -hex 24)"
echo "seekrflow_keycloak: $(openssl rand -hex 24)"

Store both somewhere safe. You enter them when you create secrets.

Record the values

Note these values. You will enter them when you create the values file and secrets.

Value	Used for	Example or format
Instance hostname	`global.defaults.postgres.host`, and the `pg-creds` secret: `PG_HOST`	The endpoint of your database instance.
Port	`global.defaults.postgres.port`	`5432`
Admin account name and password	`pg-creds` secret: `PG_USER`, `PG_PASS`	The admin credentials you set when you created the instance. SeekrFlow uses them for migrations.
Application role password	`pg-creds` secret: `PG_APP_PASS`	The password you generated for `seekrflow_app`.
Keycloak role password, if you enable Keycloak	`keycloak-credentials` secret: `db-password`	The password you generated for `seekrflow_keycloak`.

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference

Provision PostgreSQL for SeekrFlow

Create the instance

Check the instance

Generate role passwords

Record the values

​Create the instance

​Check the instance

​Generate role passwords

​Record the values

Create the instance

Check the instance

Generate role passwords

Record the values