Error: The server does not support SSL connections

[sturman]

Describe the bug

Unable to deploy Unleash with built-in Postgres DB with default DB values.

Helm Chart: unleash
Helm Chart Version: 4.1.1

Steps to reproduce the bug

1. helm repo add unleash https://docs.getunleash.io/helm-charts
2. helm template unleash unleash/unleash
3. helm install unleash unleash/unleash
4. check Unleash pod logs

Expected behavior

Unleash migrate a postgres DB and started successfully.

Logs, error output, etc.

[2024-05-10T16:01:04.890] [ERROR] server-impl.js - Locking error: The server does not support SSL connections
[2024-05-10T16:01:04.892] [ERROR] server-impl.js - Failed to migrate db Error: The server does not support SSL connections
    at Socket.<anonymous> (/unleash/node_modules/pg/lib/connection.js:77:37)
    at Object.onceWrapper (node:events:632:26)
    at Socket.emit (node:events:517:28)
    at addChunk (node:internal/streams/readable:335:12)
    at readableAddChunk (node:internal/streams/readable:308:9)
    at Readable.push (node:internal/streams/readable:245:10)
    at TCP.onStreamRead (node:internal/stream_base_commons:190:23)
node:internal/process/promises:288
            triggerUncaughtException(err, true /* fromPromise */);
            ^

Error: The server does not support SSL connections
    at Socket.<anonymous> (/unleash/node_modules/pg/lib/connection.js:77:37)
    at Object.onceWrapper (node:events:632:26)
    at Socket.emit (node:events:517:28)
    at addChunk (node:internal/streams/readable:335:12)
    at readableAddChunk (node:internal/streams/readable:308:9)
    at Readable.push (node:internal/streams/readable:245:10)
    at TCP.onStreamRead (node:internal/stream_base_commons:190:23)

Node.js v18.18.2

Screenshots

No response

Additional context

Most likely the issue is related to this change https://github.com/Unleash/helm-charts/pull/139/files#diff-9576a5f35de34ba1784129471c2262fc5bc8bd10b69c258b07f25e1a0d1f5d44R51-R54
When I downgraded to Helm Chart Version 4.0.2, Unleash started without any errors

Unleash version

No response

Subscription type

Open source

Hosting type

Self-hosted

SDK information (language and version)

No response

[vasiliyskysql]

Came here to report the same bug. Pinning to version: 4.0.2 can be used as a temporary fix.

[chriswk]

Alternately adding an environment variable saying DATABASE_SSL=false should revert back to not needing SSL for postgres. I'll have a look at updating the defaults so it should work out of the box again.

[vsimon]

There are probably multiple issues going on currently related to SSL. At a glance there is a typo in the deployment template sslRejectUnauthorizaed but that wouldn't be the root cause of this issue.

            {{- if .Values.dbConfig.sslRejectUnauthorized }}
            - name: DATABASE_SSL_REJECT_UNAUTHORIZED
              value: "{{ .Values.dbConfig.sslRejectUnauthorizaed }}"
            {{- end }}

https://github.com/Unleash/helm-charts/blob/main/charts/unleash/templates/deployment.yaml#L77

[hammadzz]

@chriswk this should be an easy fix, it is causing a break on uprade.

[rohde-spread]

Maybe this is related, for me it's not possible to pass dbConfig.ssl as false because the check in

helm-charts/charts/unleash/templates/deployment.yaml

Line 52 in 8904f5d

{{- if .Values.dbConfig.ssl }}

Will not pass the DATABASE_SSL variable in that case.
If i pass false as a string "false", it will get double quoted.

[joel-teratis]

Are there any updates on this? I am facing the same issue with chart version 5.1.3.

[joel-teratis]

Could the fix for this be this:

Current deployment.yaml:

{{- if .Values.dbConfig.ssl }}
- name: DATABASE_SSL
   value: {{ .Values.dbConfig.ssl | toJson | quote }}
{{- else if .Values.postgresql.enabled }}
- name: DATABASE_SSL
   value: "false"
{{- end }}

Fixed deployment.yaml

{{- if .Values.dbConfig.ssl }}
- name: DATABASE_SSL
   value: {{ .Values.dbConfig.ssl | toJson | quote }}
{{- else }}
- name: DATABASE_SSL
   value: "false"
{{- end }}

In this version the else if got changed to just else so that DATABASE_SSL will always be false when not setting the SSL value yourself.