Database access

Airlock Database Service proxies TCP traffic to databases using their native protocols. Users connect via airsh db connect, and Airlock validates certificates and enforces RBAC.

Supported self-hosted databases

General flow

1. Database Service connects to the Airlock cluster (join token of type db).
2. Mutual TLS authentication (mTLS) is configured between Database Service and the database.
3. The administrator creates RBAC roles with db_labels, db_names, db_users permissions.
4. The user runs airsh db ls and airsh db connect.

Join token for Database Service

airctl tokens add --type=db --format=text > /tmp/db-token

Start Database Service (Linux)

sudo airlock db configure create \
  --token=/tmp/db-token \
  --name=example-db \
  --proxy=airlock.example.com:443 \
  --protocol=postgres \
  --uri=postgres.example.com:5432 \
  --output file:///etc/airlock.yaml

sudo systemctl enable --now airlock

Role for database access

airctl create <<EOF
kind: role
version: v3
metadata:
  name: db
spec:
  allow:
    db_labels:
      '*': '*'
    db_names:
    - '*'
    db_users:
    - '*'
EOF

airctl users add --roles=access,db alice

For more on policies, see Database access policies.

User connection

airsh login --proxy=airlock.example.com --user=alice
airsh db ls
airsh db connect --db-user=postgres --db-name=postgres example-db