mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-12 10:35:06 +08:00
Benjamin Elder
8f3b500fbc
pgx resolves sslcert, sslkey and sslrootcert while it parses the connection string and pins the result for the life of the pool. Those paths are projected pod certificates that the kubelet replaces about every day, so ate-api-server kept presenting the certificate it started with; postgres verifies client certificates, so once that one expired it would refuse every new connection the pool made. Re-parse the connection string in BeforeConnect, which pgxpool calls with the per-connection copy of the config it is about to dial with. That costs one small file read per new connection and covers the trust bundle as well as the client certificate.