Postgres Summit US2026

Most Postgres roles fall into one of two buckets: a person, or a long-lived service account standing in for one. But increasingly, the "thing" connecting to your database isn't a person: it's a pod, a CI job, or an AI agent spun up for a single task — each with its own region, service, and metadata. Most of your platform stack likely already authenticates via a shared identity system. The database is typically the odd one out: still asking for a bespoke password nobody's brave enough to rotate, using a role too coarse to capture the "who" in "who did what."

This is exactly the problem "workload identity" was invented to solve everywhere else in the stack, and Postgres has some catching up to do.

This talk is about how that gap can be addressed via passwordless, certificate-based mTLS. First-class identity for Postgres, without passwords, cloud-specific IAM lock-in, or a third-party external auth provider built for users, not workloads.

This talk will cover:

• The mechanics of Mutual TLS (mTLS): CA, PKI, and certificate exchange
• Configuring Postgres & PGBouncer for passwordless, cert-based auth
• End user & ORM experience: logging in & beyond
• Basics of "workload identity" and SPIFFE/SPIRE
• Connecting SPIFFE/SPIRE with Postgres mTLS: what is possible, the tradeoffs, and what could be possible in the future

Along the way, we'll be honest about technical challenges, including client-side cert distribution, driver/ORM support, understanding "what to trust", and more. You'll leave understanding how database authentication can stop being the exception in your platform and start behaving like just another workload.