DSN String URL encoded when using Helm

[Edregol]

CHART_URL = "https://k8s.ory.sh/helm/charts"
CHART_NAME = "kratos"
CHART_VERSION = "0.45.0"

Hi everyone!

Hope you can help me out here. In a Kubernetes cluster I want Kratos to securely connect to a CockroachDB by providing this kratos.config.dsn here: cockroach://root@cockroach-cockroachdb-public:26257/kratos?sslmode=verify-full&sslrootcert=/cockroach-certs/ca.crt&sslcert=/cockroach-certs/client.root.crt&sslkey=/cockroach-certs/client.root.key

However what Kratos receives is this here: cannot parse "postgres://root@cockroach-cockroachdb-public:26257/kratos?sslcert=%2Fcockroach-certs%2Fclient.root.crt&sslkey=%2Fcockroach-certs%2Fclient.root.key&sslmode=verify-full&sslrootcert=%2Fcockroach-certs%2Fca.crt"

You'll see that every / has been replaced by %2F as well as some portions of the string have been changed. Most notably cockroach:// -> postgres:// and &sslmode=verify-full has been moved. I reckon that Kratos does some kind of sanitazation here?!

Can anyone point me in the right direction here? I am at a loss.

Many thanks!

Cheers!

[Edregol]

I'll repost the question in the kratos repository, where it belongs.

[Demonsthere]

Hello there!
In case of k8s passing the dsn this way is generally a bad idea, as you're leaking the credentials in your values.yaml file, which depending on the installation method could be more or less problematic.

The parsing issue you see is something new, as we test this method of installation for example here: https://github.com/ory/k8s/blob/master/hacks/values/keto.yaml#L8 You could check if the created configmap/secret contains a valid value or it is helm that distorts the string somehow

The advised method would be to pass kratos.config.dsn: my-placeholder-value-you-should-not-see-this and deploy the dsn as a secret (you can then store the real value in some form of secret manager, that then deploys it into the cluster as for example my-secret). This allows you to load the dsn from the secret using envs.

[Edregol]

Thanks for getting back to me!

Turns out I was focusing to much on the "cannot parse" error message. The actual error was an erroneous volume configuration which lead to a file not found exception at the end of that very long log entry😆. As soon as the volume mount was fixed the error disappeared.

And thanks for pointing out that the dsn should be a secret. Will definitely change that.👍🏼