Can we connect RDS postgres outside

[aamirsaleemchamber]

Can we connect RDS (postgres) outside which is outside the container and get the data from there rather then container inside

[tino097]

Check https://github.com/ckan/ckan-docker. Using docker you could create separate containers .

[aamirsaleemchamber]

Saw this >> https://github.com/ckan/ckan-docker it used docker compose and will create lots of services as well as postgres DB. The question here I have I don't want to create postgres DB as a container.

The DB was out side in RDS form and connect to the CKAN.

[kowh-ai]

I’d install a PostgreSQL client within the (CKAN) container first and use that to connect to the RDS instance using the endpoint/credentials in the CKAN_SQLALCHEMY_URL environment variable.

[kowh-ai]

Once you're happy it can connect you could update that environment variable for CKAN itself

[kalepugirish]

Hi kowh-ai , we are having trouble to use RDS Aurora Postgres for CKAN , Aurora DB doesnt have password and works on token based authentication , how do we define CKAN_SQLALCHEMY_URL without password?

[kowh-ai]

Wouldn't it be similar to CKAN_SQLALCHEMY_URL?...something like:

postgresql://username:<authentication-token>@<endpoint>:<port>/<database-name>

eg: postgresql://myuser:mytoken123@mydatabase.abc123.us-east-1.rds.amazonaws.com:5432/mydatabase

[kowh-ai]

You could generate this token through the AWS RDS console (or the CLI)

[kalepugirish]

Thank you ! but token changes every 15 mins or so , how do we authenticate CKAN when token expires?

[kowh-ai]

Ah, yes that could be tricky...I think you'd have to use some sort of external vault (like Hashicorp Vault) and retrieve the connection string using a Python library like hvac

[kalepugirish]

One more issue that we are facing is token generated has too many special characters and it didn’t like , throws fatal password authentication error the same pwd works fine out side ckan, tried urllib library too to convert the string but no luck :(

[kowh-ai]

If you are using Hashcorp Vault you can use the tokenization stanza in the Vault configuration file or API to specify the allowed_special_characters field. This field allows you to define a list of special characters that are allowed to be used when generating tokens. You could restrict to just a couple of special characters (@# for instance). If you aren't using Vault you still may be able to use something similar.