pgAdmin

pgAdmin

Web-based administration UI for PostgreSQL. Runs in the default namespace of the k3s cluster, fronted by Traefik.

Deployment

Item	Value
Image	docker.io/dpage/pgadmin4:9.15
Namespace	default
Replicas	1
Node placement	Pinned to cm4-left via nodeSelector
Service	ClusterIP, port 80
Ingress	Traefik IngressRoute — pgadmin.prod-k3s.iot-proxmox.net / www.pgadmin.prod-k3s.iot-proxmox.net, TLS via the shared local-example-com-tls wildcard cert, plus a pgadmin-headers middleware (HSTS, CSP, X-Frame-Options: SAMEORIGIN) on the bare hostname
Storage	pgadmin-data PVC, 1Gi, longhorn storage class, mounted at /var/lib/pgadmin
Auto-reload	reloader.stakater.com/auto: "true"

A separate pgadmin namespace also exists on the cluster but holds no resources — the app actually runs entirely in default. Likely a leftover from an earlier manifest revision.

Configuration

• PGADMIN_DEFAULT_EMAIL — set via env var to the admin account email.
• PGADMIN_DEFAULT_PASSWORD — sourced from the pgadmin Secret.
• PGADMIN_CONFIG_PROXY_X_FOR_COUNT / PROXY_X_PROTO_COUNT / PROXY_X_HOST_COUNT all set to 1, so pgAdmin trusts the single reverse-proxy hop from Traefik when reading X-Forwarded-* headers.
• A pgadmin-config ConfigMap pre-seeds servers.json (mounted read-only at /pgadmin4/servers.json) with one pre-registered connection to the cluster’s PostgreSQL host on port 5432.

PostgreSQL Server Registered

Field	Value
Host	192.168.1.69
Port	5432
Username	user
SSL Mode	prefer
Maintenance DB	postgres

The stored connection has no saved password — pgAdmin still prompts for the PostgreSQL password on first connect per session.