feat(helm): add optional PostgreSQL backing store with Secret-based credentials#1579
Draft
sauagarwa wants to merge 2 commits into
Draft
feat(helm): add optional PostgreSQL backing store with Secret-based credentials#1579sauagarwa wants to merge 2 commits into
sauagarwa wants to merge 2 commits into
Conversation
sauagarwa
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
sauagarwa
force-pushed
the
feat/helm-postgres-secret
branch
3 times, most recently
from
1fc9bef to
253051f
Compare
…redentials Add postgres.enabled toggle supporting three modes: SQLite (default), bundled Bitnami PostgreSQL (internal), and external PostgreSQL. Database credentials are stored in a Kubernetes Secret and injected via the OPENSHELL_DB_URL env var to avoid exposing passwords in CLI args, pod specs, or process listings. Passwords are URL-encoded via urlquery, and required guards prevent misconfiguration (missing password or host).
sauagarwa
force-pushed
the
feat/helm-postgres-secret
branch
from
253051f to
d8d0be7
Compare
- JWT signing key defaultMode auto-selects 0440 (fsGroup set) or 0444 (OpenShift random UID) instead of unconditional 0444. Configurable via server.sandboxJwt.secretDefaultMode for strict environments. - Deploy skill: guard against empty --version on OCI deploys, support local chart paths with dependency build, add CLEAN_INSTALL opt-in for stale PVC cleanup, and improve version derivation logic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add an optional PostgreSQL backing store to the Helm chart as an alternative to the default SQLite database. Credentials are stored in a Kubernetes Secret and injected via the
OPENSHELL_DB_URLenvironment variable, avoiding exposure in CLI args, pod specs, or process listings.Related Issue
N/A
Changes
postgresvalues block supporting three modes: SQLite (default), bundled Bitnami PostgreSQL (mode=internal), and external PostgreSQL (mode=externalorexternal.url)db-secret.yamltemplate — Kubernetes Secret created only whenpostgres.enabled=true, containing the composed database URL--db-urlCLI arg (SQLite only) andOPENSHELL_DB_URLenv var viasecretKeyRef(PostgreSQL), plus a checksum annotation for rollout on credential changeurlqueryencoding on username/password,requiredguards onauth.password(internal) andexternal.host/external.password(external mode), no hardcoded default passwordpostgres.enabled).gitignore— excludedeploy/helm/openshell/charts/(regenerated byhelm dependency build); commitChart.lockfor reproducibilitydeploy-openshell-clusterskill — new agent skill for deploying the gateway with optional PostgreSQL configurationTesting
helm lintpasses (defaults + all 5 CI variants)helm unittestpasses (30/30 tests across 3 suites)helm templateverified for SQLite default, internal postgres, and external postgres modesrequiredguard verified:helm template --set postgres.enabled=truefails with clear error when password is missingmise run pre-commit(Rust compile not applicable — Helm-only changes)Checklist