Overview

What You Will Build

Instance name placeholder: All examples use PG_LAB as the Snowflake Postgres instance name. Substitute your own instance name throughout.

Architecture

Browser
  |  HTTPS
  v
pgAdmin4 Service  (SPCS)
  |  TCP 5432 via EAI (PRIVATE_HOST_PORT rule)
  v
SPCS Private Link Endpoint  <- provisioned by SYSTEM$PROVISION_PRIVATELINK_ENDPOINT
  |  Snowflake private network
  v
Snowflake Postgres Instance  (Private Link Service)

Key Components

Prerequisites

SPCS Infrastructure Setup

Step 1: Create Database, Schema, and Image Repository

-- SPCS Infrastructure Setup: Step 1 - Create Database, Schema, and Image Repository
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

CREATE DATABASE IF NOT EXISTS SPGAPP;
CREATE SCHEMA  IF NOT EXISTS SPGAPP.SPCS;

CREATE STAGE IF NOT EXISTS SPGAPP.SPCS.SPGAPP_STAGE;

CREATE IMAGE REPOSITORY IF NOT EXISTS SPGAPP.SPCS.IMAGES;

Step 2: Create Compute Pool

-- SPCS Infrastructure Setup: Step 2 - Create Compute Pool
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

CREATE COMPUTE POOL IF NOT EXISTS SPGAPP_POOL
  MIN_NODES         = 1
  MAX_NODES         = 2
  INSTANCE_FAMILY   = 'CPU_X64_S'
  AUTO_RESUME       = TRUE
  AUTO_SUSPEND_SECS = 300;

Step 3: Push the pgAdmin Image to the Snowflake Registry

# 1. Get your registry URL (returns something like abc123.registry.snowflakecomputing.com)
snow spcs image-registry url -c <your-connection>

# 2. Authenticate Docker to the Snowflake registry
snow spcs image-registry login -c <your-connection>

# 3. Pull the source image for the required architecture
#    SPCS runs on linux/amd64 - always specify the platform when pulling on Apple Silicon
docker pull --platform linux/amd64 dpage/pgadmin4:latest

# 4. Tag it for the Snowflake registry (image paths must be lowercase)
docker tag dpage/pgadmin4:latest <registry-url>/spgapp/spcs/images/pgadmin4:latest

# 5. Push to the Snowflake registry
docker push <registry-url>/spgapp/spcs/images/pgadmin4:latest

Enable Private Link on Postgres Instance

Step 1: Enable Private Link

-- Enable Private Link on Postgres Instance: Step 1 - Enable Private Link
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

ALTER POSTGRES INSTANCE PG_LAB ENABLE PRIVATELINK;

Step 2: Wait for Private Link to Become Available

-- Enable Private Link on Postgres Instance: Step 2 - Wait for Private Link to Become Available
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

DESCRIBE POSTGRES INSTANCE PG_LAB;

Step 3: Capture Connection Details

-- Enable Private Link on Postgres Instance: Step 3 - Capture Connection Details
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

SET plinksi     = '<privatelink_service_identifier value from DESCRIBE>';
SET pghost      = '<host value from DESCRIBE>';
SET pghost_port = $pghost || ':5432';

Provision the SPCS Private Link Endpoint

Step 1: Provision the Endpoint

-- Provision the SPCS Private Link Endpoint: Step 1 - Provision the Endpoint
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

SELECT SYSTEM$PROVISION_PRIVATELINK_ENDPOINT($plinksi, $pghost);

Step 2: Authorize the Connection

-- Provision the SPCS Private Link Endpoint: Step 2 - Authorize the Connection
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

SHOW PRIVATELINK CONNECTIONS IN POSTGRES INSTANCE PG_LAB;

ALTER POSTGRES INSTANCE PG_LAB AUTHORIZE PRIVATELINK CONNECTIONS = ('<connection_id from SHOW PRIVATELINK CONNECTIONS>');

Step 3: Verify the Connection

-- Provision the SPCS Private Link Endpoint: Step 3 - Verify the Connection
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

SHOW PRIVATELINK CONNECTIONS IN POSTGRES INSTANCE PG_LAB;

Configure SPCS Network Access

Step 1: Create the Egress Network Rule

-- Configure SPCS Network Access: Step 1 - Create the Egress Network Rule
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;
USE SCHEMA SPGAPP.SPCS;

CREATE OR REPLACE NETWORK RULE spg_private_rule
  MODE       = EGRESS
  TYPE       = PRIVATE_HOST_PORT
  VALUE_LIST = ($pghost_port);

Step 2: Create the pgAdmin Credentials Secret

-- Configure SPCS Network Access: Step 2 - Create the pgAdmin Credentials Secret
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;
USE SCHEMA SPGAPP.SPCS;

CREATE OR REPLACE SECRET pgadmin_password
  TYPE     = PASSWORD
  USERNAME = '[email protected]'
  PASSWORD = 'change-me-before-production';

Security note: Change the password to something strong before deploying. The secret value is encrypted at rest and only decrypted at container start time.

Step 3: Create the External Access Integration

-- Configure SPCS Network Access: Step 3 - Create the External Access Integration
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION spg_pg_lab_eai
  ALLOWED_NETWORK_RULES          = (spgapp.spcs.spg_private_rule)
  ALLOWED_AUTHENTICATION_SECRETS = (spgapp.spcs.pgadmin_password)
  ENABLED                        = TRUE;

Deploy the pgAdmin Service

Step 1: Create the Service

-- Deploy the pgAdmin Service: Step 1 - Create the Service
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;
USE SCHEMA SPGAPP.SPCS;

CREATE SERVICE IF NOT EXISTS PGADMIN4
  IN COMPUTE POOL SPGAPP_POOL
  MIN_INSTANCES = 1
  MAX_INSTANCES = 1
  FROM SPECIFICATION $$
spec:
  containers:
    - name: pgadmin4
      image: "/spgapp/spcs/images/pgadmin4:latest"
      secrets:
        - snowflakeSecret: spgapp.spcs.pgadmin_password
          secretKeyRef: username
          envVarName: PGADMIN_DEFAULT_EMAIL
        - snowflakeSecret: spgapp.spcs.pgadmin_password
          secretKeyRef: password
          envVarName: PGADMIN_DEFAULT_PASSWORD
      env:
        PGADMIN_LISTEN_ADDRESS:                    "0.0.0.0"
        PGADMIN_LISTEN_PORT:                       "80"
        PGADMIN_DISABLE_POSTFIX:                   "1"
        PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION: "False"
      readinessProbe:
        port: 80
        path: /misc/ping
      volumeMounts:
        - name: pgadmin-data
          mountPath: /var/lib/pgadmin
  endpoints:
    - name: http
      port: 80
      public: true
  volumes:
    - name: pgadmin-data
      source: local
      uid: 5050
      gid: 5050
$$;

Step 2: Attach the External Access Integration

-- Deploy the pgAdmin Service: Step 2 - Attach the External Access Integration
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

ALTER SERVICE SPGAPP.SPCS.PGADMIN4
  SET EXTERNAL_ACCESS_INTEGRATIONS = (spg_pg_lab_eai);

Step 3: Grant Access to the Service Endpoint

-- Deploy the pgAdmin Service: Step 3 - Grant Access to the Service Endpoint
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

GRANT SERVICE ROLE SPGAPP.SPCS.PGADMIN4!ALL_ENDPOINTS_USAGE TO ROLE <your_role>;

Step 4: Wait for the Service to Start

-- Deploy the pgAdmin Service: Step 4 - Wait for the Service to Start
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

DESCRIBE SERVICE SPGAPP.SPCS.PGADMIN4;

SHOW ENDPOINTS IN SERVICE SPGAPP.SPCS.PGADMIN4;

Connect pgAdmin to Snowflake Postgres

Register the Snowflake Postgres Connection

Snowflake Postgres requires TLS on all connections. Setting SSL mode to Require (or higher) is mandatory.

Monitoring and Troubleshooting

Check Service Status

snow spcs service describe SPGAPP.SPCS.PGADMIN4 -c <your-connection>
snow spcs service list-instances SPGAPP.SPCS.PGADMIN4 -c <your-connection>

View Container Logs

snow spcs service logs SPGAPP.SPCS.PGADMIN4 \
  --container-name pgadmin4 \
  --instance-id 0 \
  -c <your-connection>

Common Issues

Suspend and Resume to Save Credits

-- Suspend and resume the service
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

ALTER SERVICE      SPGAPP.SPCS.PGADMIN4 SUSPEND;
ALTER SERVICE      SPGAPP.SPCS.PGADMIN4 RESUME;

ALTER COMPUTE POOL SPGAPP_POOL SUSPEND;
ALTER COMPUTE POOL SPGAPP_POOL RESUME;

Cleanup

Step 1: Revoke Private Link and Drop Service

-- Cleanup: Step 1 - Revoke Private Link and Drop Service
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

ALTER POSTGRES INSTANCE PG_LAB REVOKE PRIVATELINK CONNECTIONS = ($connid);

DROP SERVICE           IF EXISTS SPGAPP.SPCS.PGADMIN4;
DROP INTEGRATION       IF EXISTS spg_pg_lab_eai;
DROP NETWORK RULE      IF EXISTS spgapp.spcs.spg_private_rule;
DROP SECRET            IF EXISTS spgapp.spcs.pgadmin_password;

Step 2: Drop Compute and Storage (Optional)

-- Cleanup: Step 2 - Drop Compute and Storage (Optional)
-- Execute in: Snowsight (Snowflake)
USE ROLE ACCOUNTADMIN;

ALTER COMPUTE POOL    SPGAPP_POOL SUSPEND;
DROP COMPUTE POOL     IF EXISTS SPGAPP_POOL;
DROP IMAGE REPOSITORY IF EXISTS SPGAPP.SPCS.IMAGES;
DROP STAGE            IF EXISTS SPGAPP.SPCS.SPGAPP_STAGE;
DROP SCHEMA           IF EXISTS SPGAPP.SPCS;
DROP DATABASE         IF EXISTS SPGAPP;

Conclusion and Resources

What You Learned

Key Capabilities Demonstrated

Related Resources