Repository navigation
fix(postgres): point the trust-anchor comment at the published projection - #4063
Conversation
…tion The comment sent operators to a ca.crt key in <release>-credentials. That Secret is rendered by this chart from .Values.users and carries password entries only, so there is nothing in it to verify a server certificate against. The anchor a tenant can reach is the key-free <release>.tenant-ca that the CA extraction controller publishes from the sentinel this chart renders, delivered through the tenantsecrets API. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review. 📝 WalkthroughWalkthroughUpdated PostgreSQL TLS documentation to reference the controller-published ChangesPostgreSQL TLS documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This change corrects TLS Secret reference documentation without changing chart behavior. No current merge-readiness risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
size/XS
There was a problem hiding this comment.
Superseded by #4063 (review), which states the same conclusion in a fraction of the space. The original text is removed rather than left as a second copy of the same review.
IvanHunters
left a comment
IvanHunters
left a comment
There was a problem hiding this comment.
Verdict
LGTM
The old text told the reader to take ca.crt from <release>-credentials. That Secret is rendered at packages/apps/postgres/templates/init-script.yaml:18-27 from .Values.users, keyed by username, so the key was never there. The new text points at <release>.tenant-ca, which is what the CA controller actually publishes.
Checked the replacement rather than trusting it: the projection name comes from internal/controller/cacert/reconciler.go:354, and pkg/registry/apps/application/rest.go:275 builds the HelmRelease name with no releaseName override, so <release> means the same string in all three names the comment uses. packages/system/postgres-rd/cozyrds/postgres.yaml:45-46 and the base and use tiers in cozystack-basics make the anchor reachable to a tenant. Rendering the chart at base and at head across seven value combinations produced byte-identical output, so nothing reaches the apiserver differently.
Recommended follow-ups
- The block uses
#, which Helm copies into every renderedCluster, while the backup rationale lower in the same file uses{{/* */}}and is stripped. Worth switching while someone is in here. - The same explanation now lives in
README.md:178-190and indb.yaml:20-25with nothing keeping them in sync. The README is the copy a tenant reads.
Superseded by the inline review linked above.
2 participants
What this PR does
The TLS comment in
db.yamltold operators to takeca.crtfrom<release>-credentials. That key is not there. The chart renders that Secret from.Values.users, so it holds passwords and nothing else.The anchor a tenant can reach is
<release>.tenant-ca, which the CA-extraction controller publishes from the sentinel this chart already renders intemplates/tenant-projection.yaml, and which tenants read throughtenantsecrets. The comment points there now. It also names the two Secrets it is not, because CNPG's own<release>-cais one dash away and holds the CA private key next toca.crt.Comment only.
README.mdalready documented the projection correctly and needed no change, andhelm unittest packages/apps/postgresis green.Screenshots
Not a UI change.
Downstream repositories
A comment inside one chart template.
values.yaml,values.schema.json,Chart.yamlandREADME.mdare untouched, so the generated reference page does not move, and no schema field, default, version enum, release prefix or Secret name changes.Release note
Summary by CodeRabbit
<release>.tenant-caSecret.