Connect to a Managed Service

​

Find the connection details

• the namespace, which is the service name;
• each address, with a Copy button;
• the name of the Secret that holds the credentials;
• for each key in that Secret, a kubectl command that prints its value.

​

Addresses and Secrets

​

Read a value

kubectl get secret <secret> -n <service> -o jsonpath='{.data.<key>}' | base64 -d

kubectl get secret postgresql-app -n orders-db -o jsonpath='{.data.fqdn-uri}' | base64 -d

kubectl get secret opensearch-credentials -n search -o jsonpath='{.data.ca\.crt}' | base64 -d > opensearch-ca.crt

​

Wire it into an application

kubectl create secret generic orders-db-connection -n storefront \
  --from-literal=DATABASE_URL="$(kubectl get secret postgresql-app -n orders-db -o jsonpath='{.data.fqdn-uri}' | base64 -d)"

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: orders-db-connection
        key: DATABASE_URL

​

Notes per service

• PostgreSQL. From another namespace, use fqdn-uri, or fqdn-jdbc-uri for JDBC. The operator also writes uri, jdbc-uri and host keys, but they name the short host postgresql-rw, which resolves only inside the service’s own namespace. You connect as app, the owner of the database app, and superuser access is off. The read-only address reaches replicas only, so it answers only when instances is above 1. The image includes the pgvector and pgaudit extensions.
• Valkey. Authenticate as the default user with password; url is a complete redis:// URL. Write to the primary address. The read-replicas address serves reads from every pod.
• NATS. Connect as app. url carries no credentials, so pass username and password separately. JetStream is on; memory-backed streams are disabled.
• OpenSearch. Use HTTPS with basic auth as admin, the only user. The certificate is signed by a private CA generated in the cluster: have your client trust ca.crt.
• SeaweedFS. Use the S3 API over plain HTTP inside the cluster, with path-style addressing. The admin key pair can read, write, list and administer buckets. The read-only key pair can only read.
• VictoriaLogs. Send logs over HTTP with basic auth, as JSON lines, Loki push, OpenTelemetry or Elasticsearch bulk, and query them with LogsQL. No log collector is installed, so ship logs with your own agent.
• VictoriaMetrics. Push metrics with basic auth using Prometheus remote_write, OpenTelemetry, InfluxDB or another supported protocol, and query with PromQL or MetricsQL on the Prometheus HTTP API. It scrapes nothing itself, so push from vmagent, a Prometheus agent or an OpenTelemetry Collector.

​

Check that the service answers

kubectl get pods -n <service>

kubectl wait --for=condition=Ready clusters.postgresql.cnpg.io/postgresql -n <service> --timeout=5m

​

Next steps