Tanzu Hub 10.3.x Installation Stalls on Postgres Due to Reverse-DNS Lookups in Default pg_hba Rules

Products

• VMware Tanzu Platform - Hub

Issue/Introduction

During installation or reconciliation of VMware Tanzu Platform - Hub 10.3.x, Postgres connections may stall or time out. This can affect streaming replication between HA replicas, LDAP-authenticated client connections, or other TCP connections made as the postgres superuser.

Environment

- VMware Tanzu Platform - Hub
- Tanzu Platform

Cause

The Postgres Operator's default pg_hba.conf includes three rules that use the hostname localhost instead of an IP address or a pg_hba keyword:

```
host all postgres localhost trust
host replication "replication" localhost trust
host all ldap_user localhost trust
```

Any TCP connection to these roles that does not originate from '127.0.0.1'/'::1' triggers a reverse DNS lookup of the client's IP address, followed by a forward lookup to confirm the match. In environments where the upstream DNS resolver takes several seconds to answer (or fails to answer) a private-range PTR query, this exceeds connection and health-check timeouts.

Resolution

Replace the three affected entries using Patroni's dynamic configuration, run from inside the Postgres pod's 'pg-container'.

Step 1: Replace the three localhost entries with IP-based equivalents (127.0.0.1/32 / ::1/128), keeping the rest of the pg_hba list unchanged:

kubectl exec -n <namespace> -i <postgres-pod> -c pg-container -- patronictl edit-config --apply - --force <<'EOF'
postgresql:
  pg_hba:
  - local all all  trust
  - host all all 127.0.0.1/32 trust
  - host all all ::1/128 trust
  - local replication "all"  trust
  - host replication "all" 127.0.0.1/32 trust
  - host replication "all" ::1/128 trust
  - local all postgres  trust
  - host all postgres 127.0.0.1/32 trust
  - host all postgres ::1/128 trust
  - host replication "replication" 127.0.0.1/32 trust
  - host replication "replication" ::1/128 trust
  - hostssl replication "replication" all cert
  - hostssl "postgres" "replication" all cert
  - host all ldap_user 127.0.0.1/32 trust
  - host all ldap_user ::1/128 trust
  - host all all 0.0.0.0/0 scram-sha-256
EOF

Adjust the full list above to match your instance's actual pg_hba entries first (patronictl show-config prints the current list) — only the three localhost lines need to change.

Step 2: Confirm the change took effect:

kubectl exec -n <namespace> <postgres-pod> -c pg-container -- grep -v '^#' /pgsql/data/pg_hba.conf

This change is not persisted across Hub Apply Change operations and must be reapplied after each reconciliation.

Additional Information

• Configuring the pg_hba.conf File
• Postgres CRD Reference