From 94c5a82639eb4de64505d0d81632ba349712d66b Mon Sep 17 00:00:00 2001 From: Jeremy Alvis Date: Wed, 2 Sep 2026 14:16:08 -0700 Subject: [PATCH] Expose PostgreSQL migration settings in the Helm chart --- charts/substrate/README.md | 2 ++ charts/substrate/templates/ate-api-server-envvars.yaml | 4 ++++ charts/substrate/templates/ate-api-server.yaml | 1 + charts/substrate/templates/postgres.yaml | 2 ++ charts/substrate/values.yaml | 2 ++ hack/render-manifests.sh | 9 ++++++--- manifests/ate-install/ate-api-server-envvars.yaml | 1 + 7 files changed, 18 insertions(+), 3 deletions(-) diff --git a/charts/substrate/README.md b/charts/substrate/README.md index e7364f4e37..0640c9e9a7 100644 --- a/charts/substrate/README.md +++ b/charts/substrate/README.md @@ -35,7 +35,9 @@ See `values.yaml` for the full set; the important keys: | Key | Default | Notes | |-----|---------|-------| +| `postgres.enabled` | `true` | Deploy the bundled PostgreSQL instance | | `postgres.connectionString` | `""` (in-cluster) | Override to use external PostgreSQL | +| `postgres.schema` | `public` | Store the Substrate tables in this PostgreSQL schema | | `postgres.storageSize` | `1Gi` | In-cluster PostgreSQL PVC size | | `rustfs.enabled` | `true` | Deploy an in-cluster S3-compatible RustFS bucket for snapshots | | `atelet.storageBackend` | `s3` | Default snapshot backend, wired to RustFS when `rustfs.enabled=true` | diff --git a/charts/substrate/templates/ate-api-server-envvars.yaml b/charts/substrate/templates/ate-api-server-envvars.yaml index 753c47178b..ca76ae3ef8 100644 --- a/charts/substrate/templates/ate-api-server-envvars.yaml +++ b/charts/substrate/templates/ate-api-server-envvars.yaml @@ -14,6 +14,9 @@ See the License for the specific language governing permissions and limitations under the License. */}} +{{- if and (not .Values.postgres.enabled) (empty .Values.postgres.connectionString) }} +{{- fail "postgres.connectionString is required when postgres.enabled=false" }} +{{- end }} apiVersion: v1 kind: ConfigMap metadata: @@ -21,3 +24,4 @@ metadata: namespace: {{ .Release.Namespace }} data: ATE_API_POSTGRES_CONNECTION_STRING: {{ .Values.postgres.connectionString | default (printf "postgresql://postgres@%s.%s.svc:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=/run/podidentity.podcert.ate.dev/credential-bundle.pem&sslkey=/run/podidentity.podcert.ate.dev/credential-bundle.pem" (include "substrate.fullname" (list "postgres" .)) .Release.Namespace) | quote }} + ATE_API_POSTGRES_SCHEMA: {{ .Values.postgres.schema | quote }} diff --git a/charts/substrate/templates/ate-api-server.yaml b/charts/substrate/templates/ate-api-server.yaml index a5073bc9fa..c236999e48 100644 --- a/charts/substrate/templates/ate-api-server.yaml +++ b/charts/substrate/templates/ate-api-server.yaml @@ -85,6 +85,7 @@ spec: - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem" - "--authentication-config=/etc/ateapi/authentication/authentication.yaml" - "--postgres-connection-string=@env" + - "--postgres-schema=@env" - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json" - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json" - "--egress-gateway-address={{ include "substrate.fullname" (list "atenet-egress" .) }}.{{ .Release.Namespace }}.svc:443" diff --git a/charts/substrate/templates/postgres.yaml b/charts/substrate/templates/postgres.yaml index ce4a4efdd7..26ddb0b1ec 100644 --- a/charts/substrate/templates/postgres.yaml +++ b/charts/substrate/templates/postgres.yaml @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */}} +{{- if .Values.postgres.enabled }} {{- $name := include "substrate.fullname" (list "postgres" .) -}} apiVersion: v1 kind: ConfigMap @@ -232,3 +233,4 @@ spec: resources: requests: storage: {{ .Values.postgres.storageSize }} +{{- end }} diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml index 48ce963668..6bb83019ed 100644 --- a/charts/substrate/values.yaml +++ b/charts/substrate/values.yaml @@ -24,8 +24,10 @@ createNamespace: false postgres: + enabled: true storageSize: 1Gi connectionString: "" + schema: public resources: requests: cpu: "1" diff --git a/hack/render-manifests.sh b/hack/render-manifests.sh index d8a7f69e8a..fc6b8d6858 100755 --- a/hack/render-manifests.sh +++ b/hack/render-manifests.sh @@ -121,8 +121,9 @@ if [ "${CHECK_MODE}" = "true" ]; then trap 'rm -rf "$TMP_DIR" "$CHECK_TMP"' EXIT mkdir -p "${CHECK_TMP}/current" find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' -exec cp {} "${CHECK_TMP}/current/" \; - rm -f "${PRESERVED_FILES[@]/#/${CHECK_TMP}\/current\/}" - rm -f "${PRESERVED_FILES[@]/#/${TMP_DIR}\/out\/}" + for file in "${PRESERVED_FILES[@]}"; do + rm -f "${CHECK_TMP}/current/${file}" "${TMP_DIR}/out/${file}" + done if ! diff -ruN "${CHECK_TMP}/current" "${TMP_DIR}/out" >/dev/null 2>&1; then echo "manifests/ate-install/ is out of date. Run: make helm-template" >&2 diff -ruN "${CHECK_TMP}/current" "${TMP_DIR}/out" | head -60 >&2 || true @@ -150,7 +151,9 @@ find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' \ ! -name 'sandboxconfig-gvisor.yaml' \ ! -name 'sandboxconfig-validation.yaml' \ -delete -rm -f "${PRESERVED_FILES[@]/#/${TMP_DIR}\/out\/}" +for file in "${PRESERVED_FILES[@]}"; do + rm -f "${TMP_DIR}/out/${file}" +done cp "${TMP_DIR}/out/"*.yaml "${OUT_DIR}/" rendered_count="$(find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' | wc -l | xargs)" echo "Rendered ${rendered_count} manifest files into ${OUT_DIR}" diff --git a/manifests/ate-install/ate-api-server-envvars.yaml b/manifests/ate-install/ate-api-server-envvars.yaml index 5199ab9e74..b49cff6e1e 100644 --- a/manifests/ate-install/ate-api-server-envvars.yaml +++ b/manifests/ate-install/ate-api-server-envvars.yaml @@ -22,3 +22,4 @@ metadata: namespace: ate-system data: ATE_API_POSTGRES_CONNECTION_STRING: "postgresql://postgres@postgres.ate-system.svc:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=/run/podidentity.podcert.ate.dev/credential-bundle.pem&sslkey=/run/podidentity.podcert.ate.dev/credential-bundle.pem" + ATE_API_POSTGRES_SCHEMA: "public"