UNCLASSIFIED - NO CUI

Enterprise Feeds Database user created with wrong password

Summary

During an update to the Anchore database creation jobs, a bug was introduced where the PGPASSWORD environment variable from the anchore-db-credentials is used instead of the feeds-db-credentials PGPASSWORD value in the creation of the Anchore feeds database user. This results in a confusing issue where if a unique password is supplied for the feeds database user, it is ignored completely and instead the anchore database password is used.

Steps to reproduce

  1. Set a unique password for the feeds database user (distinct from the one used for the anchore database user)
  2. Use a superuser to create the anchore databases and users by setting .Values.addons.anchore.values.postgresSuperUser.[postgresUsername|postgresPassword]
  3. Reconcile changes to flux
  4. The enterprise feeds deployment will crashloopbackoff with authentication errors from the feeds database

What is the current behavior?

The feeds deployment is broken if a distinct password is used for the feeds database user.

What is the expected behavior?

The ensure-feeds-db job should use the password supplied in the feeds-db-credentials Secret.

Relevant logs and/or screenshots

(Background on this error at: https://sqlalche.me/e/14/e3q8)
[MainThread] [anchore_manager.util.db/connect_database()] [INFO] DB attempting to connect...
[MainThread] [anchore_manager.util.db/connect_database()] [WARN] DB connection failed, retrying - exception: test connection failed - exception: (psycopg2.OperationalError) FATAL:  password authentication failed for user "redacted"
FATAL:  password authentication failed for user "redacted"

Possible fixes

Update this line to use the feeds-db-credentials Secret. (If you can, link to the line of code that might be responsible for the problem)

/cc {put CODEOWNERs @githandles here}

Edited by Tim Seagren