Kvindo™ Cloud Docs
A PostgreSQL User is a login user inside a specific PostgreSQL Cluster's own catalog. It is the real access path for that cluster — the cluster resource itself has no user-facing credential, so create at least one User to actually connect.
• Belongs to one cluster forever — spec.postgreSqlId is required and immutable; a user cannot move between clusters
• Write-only password — spec.password is never echoed back by the API, same as every other credential field on this platform. Omit it on a modify to keep the current password
• No default user — creating a cluster does not create a user automatically; this mirrors how a fresh Kubernetes cluster has no default KubernetesUser either
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| PostgreSql cluster | spec.postgreSqlId |
spec.postgre_sql_id |
No | ULID — references a PostgreSql cluster | — | No | Immutable after creation |
| Password | spec.password |
spec.password |
Yes | string (sensitive, write-only) | — | No | Never returned in status. Required when login is true; not required (and has no effect) when login is false |
| Login | spec.login |
spec.login |
No | boolean | — | No | A login user with no password can never actually connect |
| Connection limit | spec.connectionLimit |
spec.connection_limit |
Yes | integer | a share of the cluster's connection budget, at most 50 | No | Maximum concurrent connections for this user. Left unset, the user gets a share of what the cluster's nodes can actually serve, divided among the users that did not ask for a specific number. When set, in transaction pooling it must cover every pool this user can reach — the granted databases plus the maintenance database and postgres — because the pooler keeps a separate connection pool per database and divides the limit across them. In session pooling nothing is divided: the number is the user's concurrent-session ceiling per pool, so a value below that count is accepted |
| Pool mode | spec.poolMode |
spec.pool_mode |
Yes | string: session, transaction or statement |
unset (the platform default, transaction) |
No | Which pooling mode the Odyssey connection pooler uses for this user's routes. transaction (the default) multiplexes hardest but cannot carry session-scoped state: LISTEN/NOTIFY, temporary tables, WITH HOLD cursors, session-level advisory locks, SET, and prepared statements. session restores all of that by holding a server connection for the client's whole session — and changes what connectionLimit means for this user: it becomes the number of concurrent sessions, not a budget divided across databases. statement returns the connection after every query, so any multi-statement transaction fails. Omitting the field on a direct API or kc modify returns the user to the default; in Terraform the attribute is computed, so removing it from the configuration leaves the current value — set it to transaction explicitly to go back to the default |
| Granted database ids | spec.grantedDatabaseIds |
spec.granted_database_ids |
Yes | list of ULIDs — references PostgreSqlDatabase resources | [] (no databases granted) | No | The PostgreSql Database resources this user is granted access to |
A login user on an existing cluster.
Terraform
Python SDK
kc CLI
Resource docs
Examples
More in this section