Issue: AWX cannot connect to Aurora PostgreSQL 17 due to SSL

Get Help
, , ,
1

**AWX cannot connect to Aurora PostgreSQL 17 **.

Environment

AWX Operator Version: (add your version, e.g., 2.19.1)
AWX Version: 3.2.0
Kubernetes Version: v1.33
PostgreSQL: AWS Aurora PostgreSQL v17
Deployment: External DB (Aurora) + AWX on EKS

Description of the Issue

When deploying AWX with an external Aurora PostgreSQL 17 database on an EKS v1.33 cluster, AWX fails to establish a PostgreSQL connection.
Aurora receives invalid SSL packets, and AWX logs report certificate verification errors. As a result, AWX containers enter a crash loop and never complete initialization.

Steps to Reproduce

  • Deploy Aurora PostgreSQL Compatible Edition v17.
  • Deploy AWX Operator with a custom AWX CR referencing the Aurora endpoint.
  • Observe AWX pods.
    image
    image1405×340 27.6 KB

values.yaml

AWX:
  # enable use of awx-deploy template
  enabled: true
  name: awx
  spec:
    admin_user: admin

  # configurations for external postgres instance
  postgres:
    enabled: true
    host: cid-poc1-awx-rds-.cluster-.us-east-1.rds.amazonaws.com
    port: 5432
    dbName: awx
    username: ulKrPh2p8qrNBo4Q
    # for secret management, pass in the password independently of this file
    # at the command line, use --set AWX.postgres.password
    password: Unset
    sslmode: verify-full
    type: unmanaged

rbac:
  create: true

operator-controller: {}

operator-controller-containers: {}

Relevant Aurora DB Logs

2026-02-12 19:00:39 UTC:10.205.26.178(48258):[unknown]@[unknown]:[21050]:LOG:
could not accept SSL connection: BAD_PACKET_LENGTH

kubectl logs awx-web-7fcdbdf94f-w5q9h -n awx

image
image1882×982 74 KB

image
image1885×1049 70.8 KB

Relevant AWX Pod Logs (awx-web)
The AWX application repeatedly fails with certificate errors:

psycopg.OperationalError: connection failed: certificate verify failed
django.db.utils.OperationalError: connection failed: certificate verify failed

AWX web container eventually enters FATAL state:
WARN exited: awx-cache-clear (exit status 1; not expected)
...

gave up: awx-cache-clear entered FATAL state, too many start retries too quickly

2

You need to configure and provide AWS certificates for creating the SSL connection to your database.
Your kubernetes deployment manifest for AWX needs a reference to cert bundle secret, i.e. bundle_cacert_secret: bundle-cacert-secret . This secret has to contain the public certificates which AWS provides individually for every region. You can create it like this: kubectl create secret generic bundle-cacert-secret --from-file=bundle-ca.crt=YOUR_PATH_TO_CERTS/rds-ca-cert-$AwsRegion-bundle.pem --namespace awx