Human Postgres connection output says TLS required, but the managed Postgres service exercised in the 23 September release QA accepted a plaintext connection. This is a small output/help correction; changing backend enforcement is outside this issue.
Tested installed CLI 0.5.0, main df81e46cfec0bb58ea981d17cc6fd2de24442e7d.
Observed on an owned disposable service:
- Human
cloud postgres get printed Connection: ...; TLS required.
- A connection with
PGSSLMODE=disable succeeded. SELECT ssl FROM pg_stat_ssl WHERE pid=pg_backend_pid() returned false.
- A separate
verify-full connection using the service CA succeeded with TLS1.3.
The claim is emitted by render_postgres_connection_guidance, shared by get, read-replica creation and restore.
Change the guidance to distinguish the recommended connection practice from a server-enforced requirement, for example use verified TLS. Preserve the existing CA/connection workflow and JSON shapes. Do not infer that every managed service accepts plaintext or weaken connection defaults.
This is a focused follow-up to closed #836, whose scope added connection recovery guidance; no existing open issue specifically covered this inaccurate enforcement claim. No release milestone or blocker designation is requested.
Human Postgres connection output says
TLS required, but the managed Postgres service exercised in the 23 September release QA accepted a plaintext connection. This is a small output/help correction; changing backend enforcement is outside this issue.Tested installed CLI 0.5.0, main
df81e46cfec0bb58ea981d17cc6fd2de24442e7d.Observed on an owned disposable service:
cloud postgres getprintedConnection: ...; TLS required.PGSSLMODE=disablesucceeded.SELECT ssl FROM pg_stat_ssl WHERE pid=pg_backend_pid()returned false.verify-fullconnection using the service CA succeeded with TLS1.3.The claim is emitted by render_postgres_connection_guidance, shared by get, read-replica creation and restore.
Change the guidance to distinguish the recommended connection practice from a server-enforced requirement, for example
use verified TLS. Preserve the existing CA/connection workflow and JSON shapes. Do not infer that every managed service accepts plaintext or weaken connection defaults.This is a focused follow-up to closed #836, whose scope added connection recovery guidance; no existing open issue specifically covered this inaccurate enforcement claim. No release milestone or blocker designation is requested.