Is Dual-User Config for DB still recommended? How to configure this for containerized deployment?

General
, , ,
1

Pega documentation still recommends dual-user configuration with separate Admin and Base users for database access.

This is explicitly stated here:

However, Pega Helm Charts do not seem to support this configuration.

The values.yaml only has properties for one DB username and password (global:jdbc:username, global:jdbc: password).

Also the templates for context.xml seem to only create one JNDI datasource per schema and not the extra datasources for Admin-access.

Last not least, the prconfig.xml also does not inclue references to the datasources.

If the recommendation for dual-user config is still valid, helm charts and container images should be extended to support it.

I have created following feature request on GitHub to address this: Support dual-user config with separate Admin and Base users for DB · Issue #872 · pegasystems/pega-helm-charts · GitHub

If the recommendation has been superseeded, I would appreciate if the docs were adjusted accordingly.

Thanks.

2

@MalteR You’re correct, the Helm charts support configuration of a single user. Typically this is the admin user unless the organization’s policy restricts it.

3

@BrettAllen Thanks for the confirmation.

So should we assume that the recommendation in the docs (see screenshot in attachment) has been superseeded?

Source of screenshot:
https://docs.pega.com/bundle/platform/page/platform/install/db/k8s-configure-postgres-install.html#database-users-postgres

In case we still wanted to use dual-user config we would need to extend the Pega provided Helm / Docker files or wait for an extension in the GitHub project?

pega_dual_user_config.png
pega_dual_user_config.png1747×309 44.5 KB

4

@MalteRYes, currently you’d need to extend the chart or wait for this to be considered as a new feature for the chart. I’ve opened a feedback item in Agile Studio based on the enhancement request you submitted on Github. There’s no technical reason that requires the use of a separate data source (many clients have a single DB user), the privileges required to deploy RAP files can be granted to the user specified in the values.yaml.