Self hosted Postgres DB supporting external authentication

[hkrpydev-hkr]

Describe your question

Hi,

As we are going with self hosted Postgres instance (RDS Postgres) and we want to setup external authentication to connect to this Postgres instance, can we go with IAM authentication or externally managed dynamic credentials (Eg: using Vault) OR should we only use local authentication username and password?

Want to know if external authentication is supported for Postgres user or only internal authentication is supported.

Please clarify. Thanks!

Langfuse Cloud or Self-Hosted?

Self-Hosted

If Self-Hosted

No response

If Langfuse Cloud

No response

SDK and integration versions

No response

Pre-Submission Checklist

• I have checked for existing issues/discussions and consulted Langfuse AI.

[inkeep-ai-assistant[bot]]

Based on the available documentation, Langfuse's PostgreSQL configuration appears to support only traditional username/password authentication methods. The documentation shows configuration using either direct credentials or Kubernetes secrets containing username and password(1)(2).

For external PostgreSQL instances like AWS RDS, the documented approaches are:

1. Direct credentials in values.yaml(1)
2. Kubernetes secrets containing username and password(2)
3. Full DATABASE_URL connection string via environment variables(3)(2)

The documentation does not explicitly mention support for IAM authentication or dynamic credential providers like HashiCorp Vault for PostgreSQL connections. The configuration examples consistently show static username/password combinations(1)(4)(2).

However, you could potentially work around this by:

• Using the DATABASE_URL environment variable approach, which takes precedence over individual auth fields(3)(2)
• Implementing an external credential rotation mechanism that updates the Kubernetes secret containing the password
• Injecting the full connection string via langfuse.additionalEnv(3)

For a definitive answer on whether IAM authentication or Vault-managed credentials are supported, I recommend checking these potentially helpful sources or reaching out to the Langfuse team directly:

• Kubernetes (Helm) (self-hosted) - Langfuse
• Postgres Database

Would you like a general answer based on my broader knowledge instead?

📚 Sources:

1. Kubernetes (Helm) (self-hosted) - Langfuse
2. How to configure using postgresql secrets in helm value file for self host mode?
3. bug:
4. PostgreSQL Authentication Failed Despite Setting Credentials in Helm Values During Langfuse Kubernetes Deployment (Self-Hosting)

---

Have another question? Just tag @inkeep.

[jannikmaierhoefer]

Hi @hkrpydev-hkr, was inkeep helpful here?

[hkrpydev-hkr]

Hi @jannikmaierhoefer : It was to a certain extent, but still we wanted to clarify if self hosted Langfuse Postgres instance (AWS Aurora Postgres) user and password supports external authentication, as our organization practice is to go with IAM authentication or externally managed dynamic credentials (Eg: using Hashicorp Vault). Is this doable?

Based on inkeep's response, looks like only credentials with local authentication or Kubernetes secrets is supported. Is that correct?

[Steffen911]

@hkrpydev-hkr Yes, the current helm chart expects that static credentials are provided via environment variables. If you automatically rotate credentials, e.g. using Vault, you would have to update the secrets in the chart as well and make sure to restart the containers.