Database and Kubernetes access through the Monopam gateway
What changed
Every content update is versioned. Select a version to compare it with the one before.
Version 8 → 9
UpdateNew module on operating the database proxy: policy delivery after enabling it, masking gaps, statement approvals and the browser console. The module now has diagrams and a closing list of what to check first.
1 lesson updatedduration
Content update. Enrolled learners were notified.
Duration changed from 17 to 18 minutes.
The database proxy sits between the user's client and the database and judges every statement. Three situations come up in almost every rollout.
### "Everything is blocked" right after enabling the proxy
The proxy does not hold its own copy of your policies. Monopam pushes them to it over the proxy's admin port. Until that first push succeeds, the proxy **fails closed**: every statement from every user is blocked, with the reason `no policies loaded`.
So when a freshly enabled proxy blocks everything, the Database Rules are probably fine. The delivery path is the suspect. Check that the gateway configuration points to the right Monopam address and that the `Admin Token` matches. Once the push succeeds, statements are judged normally. Failing closed is the safe default: a proxy that allowed everything while it had no policy would be an open door during every restart.
### A phone number that slips through masking
Masking has two sources.
| Source | How it decides | Strength | Limit |
| --- | --- | --- | --- |
| PII auto-detect | By column name (email, phone, card and similar) and by the shape of the value | Covers schemas nobody has documented | Shape detection is deliberately strict to avoid false positives |
| Explicit masking rule | You name the column and the transformer | Exact, and it always wins over auto-detect | You must know the column |
An example of the limit: the phone detector that looks at values expects an unbroken run of digits. A value stored as `+90 532 123 45 67`, with spaces, does not match. If the column is called `phone`, the name catches it anyway. If it is called `contact_info`, neither test fires and the number is returned in clear.
The answer is not to wish the detector were looser. Add an explicit masking rule for that column. Treat auto-detect as the safety net and explicit rules as the control for every column you already know holds personal data.
### Statements that need approval
A Database Rule with the effect Approval does not run the statement. For a user on a native client such as psql or DBeaver, this is what happens:
1. The proxy refuses the statement and opens an approval request automatically.
2. If the user retries while the request is open, the retries attach to the **same** request. Approvers are not flooded.
3. The request has a 60-minute default window. If nobody decides, it expires.
4. The next attempt after that opens a **new** request.
An approver who comes in the next morning may therefore see one expired request from yesterday evening and one fresh request from today. Both belong to the same user and statement, and only the fresh one can still be decided. An approval covers exactly the statement it was raised for.
::diagram pam-statement-approval
### The browser console is not a side door
Teams sometimes assume that the browser SQL console is weaker than a native client because it is "just a web page". It is the opposite of a bypass: the console sends its statements through the same proxy, so the same rules, masking, rate limits and audit apply, and the database credential never reaches the browser. Choosing between the console and a native client is a question of convenience, not of control.
### What to check first
| Symptom | Check first |
| --- | --- |
| Every statement is blocked with `no policies loaded` | The Monopam address in the gateway configuration and the `Admin Token` |
| A personal value comes back in clear | The column name and the stored format. Then add an explicit masking rule for the column |
| An approver sees an expired request and a fresh one for the same statement | Decide the fresh one. Only that one can still be decided |