Expose PostgreSQL migration settings in the Helm chart

charts/substrate/README.md

@@ -35,7 +35,9 @@ See `values.yaml` for the full set; the important keys:
 
 | Key | Default | Notes |
 |-----|---------|-------|
+| `postgres.enabled` | `true` | Deploy the bundled PostgreSQL instance |
 | `postgres.connectionString` | `""` (in-cluster) | Override to use external PostgreSQL |
+| `postgres.schema` | `public` | Store the Substrate tables in this PostgreSQL schema |
 | `postgres.storageSize` | `1Gi` | In-cluster PostgreSQL PVC size |
 | `rustfs.enabled` | `true` | Deploy an in-cluster S3-compatible RustFS bucket for snapshots |
 | `atelet.storageBackend` | `s3` | Default snapshot backend, wired to RustFS when `rustfs.enabled=true` |

charts/substrate/templates/ate-api-server-envvars.yaml

@@ -14,10 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
+{{- if and (not .Values.postgres.enabled) (empty .Values.postgres.connectionString) }}
+{{- fail "postgres.connectionString is required when postgres.enabled=false" }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ .Values.ateApiServerEnvVarsConfigMap }}
   namespace: {{ .Release.Namespace }}
 data:
   ATE_API_POSTGRES_CONNECTION_STRING: {{ .Values.postgres.connectionString | default (printf "postgresql://postgres@%s.%s.svc:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=/run/podidentity.podcert.ate.dev/credential-bundle.pem&sslkey=/run/podidentity.podcert.ate.dev/credential-bundle.pem" (include "substrate.fullname" (list "postgres" .)) .Release.Namespace) | quote }}
+  ATE_API_POSTGRES_SCHEMA: {{ .Values.postgres.schema | quote }}

charts/substrate/templates/ate-api-server.yaml

@@ -85,6 +85,7 @@ spec:
         - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
         - "--authentication-config=/etc/ateapi/authentication/authentication.yaml"
         - "--postgres-connection-string=@env"
+        - "--postgres-schema=@env"
         - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
         - "--actor-id-ca-pool=/run/actor-id-ca-pool/pool.json"
         - "--egress-gateway-address={{ include "substrate.fullname" (list "atenet-egress" .) }}.{{ .Release.Namespace }}.svc:443"

charts/substrate/templates/postgres.yaml

@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
+{{- if .Values.postgres.enabled }}
 {{- $name := include "substrate.fullname" (list "postgres" .) -}}
 apiVersion: v1
 kind: ConfigMap
@@ -232,3 +233,4 @@ spec:
       resources:
         requests:
           storage: {{ .Values.postgres.storageSize }}
+{{- end }}

charts/substrate/values.yaml

@@ -24,8 +24,10 @@
 createNamespace: false
 
 postgres:
+  enabled: true
   storageSize: 1Gi
   connectionString: ""
+  schema: public
   resources:
     requests:
       cpu: "1"

hack/render-manifests.sh

@@ -121,8 +121,9 @@ if [ "${CHECK_MODE}" = "true" ]; then
   trap 'rm -rf "$TMP_DIR" "$CHECK_TMP"' EXIT
   mkdir -p "${CHECK_TMP}/current"
   find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' -exec cp {} "${CHECK_TMP}/current/" \;
-  rm -f "${PRESERVED_FILES[@]/#/${CHECK_TMP}\/current\/}"
-  rm -f "${PRESERVED_FILES[@]/#/${TMP_DIR}\/out\/}"
+  for file in "${PRESERVED_FILES[@]}"; do
+    rm -f "${CHECK_TMP}/current/${file}" "${TMP_DIR}/out/${file}"
+  done
   if ! diff -ruN "${CHECK_TMP}/current" "${TMP_DIR}/out" >/dev/null 2>&1; then
     echo "manifests/ate-install/ is out of date. Run: make helm-template" >&2
     diff -ruN "${CHECK_TMP}/current" "${TMP_DIR}/out" | head -60 >&2 || true
@@ -150,7 +151,9 @@ find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' \
   ! -name 'sandboxconfig-gvisor.yaml' \
   ! -name 'sandboxconfig-validation.yaml' \
   -delete
-rm -f "${PRESERVED_FILES[@]/#/${TMP_DIR}\/out\/}"
+for file in "${PRESERVED_FILES[@]}"; do
+  rm -f "${TMP_DIR}/out/${file}"
+done
 cp "${TMP_DIR}/out/"*.yaml "${OUT_DIR}/"
 rendered_count="$(find "${OUT_DIR}" -maxdepth 1 -type f -name '*.yaml' | wc -l | xargs)"
 echo "Rendered ${rendered_count} manifest files into ${OUT_DIR}"

manifests/ate-install/ate-api-server-envvars.yaml

@@ -22,3 +22,4 @@ metadata:
   namespace: ate-system
 data:
   ATE_API_POSTGRES_CONNECTION_STRING: "postgresql://postgres@postgres.ate-system.svc:5432/atepg?sslmode=verify-full&sslrootcert=/run/servicedns.podcert.ate.dev/trust-bundle.pem&sslcert=/run/podidentity.podcert.ate.dev/credential-bundle.pem&sslkey=/run/podidentity.podcert.ate.dev/credential-bundle.pem"
+  ATE_API_POSTGRES_SCHEMA: "public"