Unable to connect to PostgreSQL in a separate Kubernetes pod using Diesel in Rust

[CarolineMorton]

Setup

We have a rust server needs to connect to a postgres database. Locally this works when using docker-compose without issue. In testing environment, we are using kubernetes with the postgres database in its own pod.

(The production environment which we have not pushed to yet has the postgres db in RDS on AWS. As it is not working in the test server, we have not pushed to this yet obv!)

Versions and Feature Flags

• Rust: 1.68
• Diesel: "2.1.1", features = ["postgres", "chrono", "r2d2", "serde_json"]
• Diesel_async: "0.3.2", features = ["postgres", "bb8", "deadpool"]
• Database: postgres 14
• Operating System linux

Problem Description

We have just swapped a python server to rust on a kubernetes cluster in a testing environment. The rust server uses diesel, diesel-async and deadpool to connect to the postgres database. This works locally when we are using docker-compose to spin up the database and everything can be connected locally. This also work in CI and passes all integrations tests.

The issue is when the server is deployed into a kubernetes cluster. The database is a pod in the cluster in namespace database, and the server is in production.

This is the code that runs the connection:

use std::env;
use diesel_async::pooled_connection::{deadpool::Pool, AsyncDieselConnectionManager};
use diesel_async::pg::AsyncPgConnection;
use once_cell::sync::Lazy;

/// The database connection pool.
pub static POOL: Lazy<Pool<AsyncPgConnection>> = Lazy::new(|| {
    let connection_string = env::var("DB_URL").unwrap();
    let config = AsyncDieselConnectionManager::<diesel_async::AsyncPgConnection>::new(connection_string);
    Pool::builder(config).build().unwrap()
});

/// Gets a connection from the pool in an async manner.
#[macro_export]
macro_rules! get_connection {
    () => {
        POOL.get().await.map_err(|e| { 
            CustomError::new(
                format!("Failed to get connection: {}", e), 
                CustomErrorStatus::Unknown
            )
        })
    };
}

What are you trying to accomplish?

Connect the server to the database.

What is the expected output?

Connection to the database

What is the actual output?

The error is:

Failed to get connection: Error occurred while creating a new object: pg_hba.conf rejects connection for host <internal_url>, user <user> database <db>, no encryption

Are you seeing any additional errors?

No but I have done the following:

• checked the database credentials
• dropped the database and recreated
• tried adding the url to the allowed pgconf in the postgres database files - this is not advisable when using kubernetes but i was trying to rule things out.

[weiznich]

Thanks for opening this issue.
I've converted this issue to a discussion thread in the support forum the underlying problem is no bug in diesel-async and the issue tracker is only for bug report.

Now to the actual problem: Technically speaking your title is incorrect, as diesel-async does connect to the Postgres instance running in your cluster. This connection is then rejected on server side, which results in the shown error message. The error message is returned by the server. That also points at the origin of your problem: The configuration of your client does not match what the server expects. As the error message more or less says, you need to check your server side pg_hba.conf file for which connection kinds are accepted by your server configuration and configure your client correspondingly. It's hard to tell you how exactly the client side configuration should look like without knowing the relevant server side configuration, therefore if you expect further help you need to provide the relevant configuration and exact information about which client side configuration you've tried.

[CarolineMorton]

Thank you for your reply. I have edited the pg_hba.conf manually to allow the connections from the server. This is not a great solution as would have to be done everytime the pod respins up at a new IP address in the cluster but it is a useful data point.

My concern here and why i bought it to this project is that this was previously a diesel (no async) project and could connect without any manually configuration in the same cluster; before that it was a python server connecting to the same database before we upgraded python to rust. Is there something in how diesel-async connects that is different in terms of connection type compared to plain old diesel.

Thanks for your time.

[weiznich]

Does your default pg_hba.conf require a TLS connection? If that's the case you need to configure your connection in such a way that it provides a TLS setup. There are several solutions here, for a rustls based setup see this example).